Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to download/compile/run various c/c++ libraries from the net. These are mostly half-baked, obscure and/or abandoned projects, some of them from questionable sources. How can I ensure that they run in a safe "sandbox" type of environment? I mean that they don't touch filesystem/network resources. They should only return values for function calls I make to them.

Preferably a solution for both Win/Linux, but at least for Linux

share|improve this question

migrated from stackoverflow.com Feb 24 at 16:15

This question came from our site for professional and enthusiast programmers.

2  
Virtual Machine? –  Alex K Feb 24 at 16:00
1  
Review the code yourself, then once compiled, its actually trusted. –  Ramhound Feb 24 at 16:26
    
Why the downvotes? –  baruch Feb 24 at 18:42
    
possible cross site duplicate of: stackoverflow.com/questions/792764/… –  Ciro Santilli Aug 5 at 21:41
    
subset of: superuser.com/questions/690553/run-user-code-safely, which also asks for efficiency to run on server –  Ciro Santilli Aug 6 at 6:39

2 Answers 2

For Linux, this is ideal workload for a container. You can do this simply using Docker (http://docker.io). This enables containers to be easily created and destroyed in a matter of seconds - far quicker than a VM.

For Windows, you are stuck using a VM as far as I know.

share|improve this answer
    
I am not sure, but isn't CAMEYO something similar on Windows ? cameyo.com –  Devid May 19 at 11:41

Running the software as an unprivileged user is usually enough. Unless you're using a kernel which is vulnerable to root escalation.

sudo adduser SandBoxGuy
sudo passwd SandBoxGuy

Now login as SanBoxGuy and run your software, the software will not be able to access the files of other users or do any damage outside of the SandBoxGuy user's directory.

All that assumes that your kernel is not vulnerable to root escalation.

A bigger answer can be found here. It was written with the Raspberry Pi + Xserver in mind but it more or less suits any Linux system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.