How do I impose restrictions to a process on Linux?

Question

Can I limit the system resources that a process can use on Linux? I want to configure the system to avoid that some specified processes use some system resources:

• choose if a process is allowed to use network and Internet.
• choose which files and folders that a process can read, write or execute.
• choose if a process is allowed to use sound and graphics output, and printer.
• choose the limit of memory that it can use.

I think it is a good solution to run untrusted software without problems.

Thanks

Answer 1

The permissions of the user running the process (real user or system user...) should be appropriately set. If you're worried about a process having too much access to the rest of your system's files, can those files be secured with standard permissions? Or change the group of the user to a less permissive one?

Ignacio is on point with his SELinux, as well. Mandatory Access Controls (MAC) are very powerful and robust for this explicit purpose.

Is there a more specific problem that you're thinking of?

Answer 2

The memory limit can be handled by ulimit. For everything else there's SELinux.