Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to execute an application on my server but I do not want this application to modify any files. I expect the application to read files and to output to stdout/stderr. However, I don't know exactly what the application may try to do because it was provided to me by someone else.

What's the easiest way to accomplish this in Linux? I'm running Red Hat 5.

One way I can think of is to create a new user who only has read-level access. Is there another way to do this without creating a user?

share|improve this question
up vote 2 down vote accepted

You could use the chroot command to restrict the process to a sandbox directory.

If copying the necessary files is not feasible: Use "bind mount" in order to create a link from inside the chroot directory to outer filesystem. Run the mount command out of chroot.

mount /external/path /chroot/sandbox/ref_to_external -o bind

As you suggested: You could run your application as another user:

/bin/su - limitedUser -c "/path/to/xxxx"


 /bin/su : switch user
 - : option to su, make it a login session (source profile for the user)
 limitedUser : user to become
 -c "/path/to..." : command to run

Make sure that limitedUser belongs to a group which has only read+execute but no write rights.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.