2

Under Linux, I would like to be able to launch anything from command line in a "safe" environment, i.e. be assured that it can't read or write any file on my computer, and even better if it couldn't access the network.

I thought about creating a user with reading rights only in the current folder (and nowhere else), and su to this user to launch the command, would this work ? And what about the network ?

What would you do ?

3
  • If you can't read or write to anything, there will be no IO; The equivalent of a stone weight on CPU.
    – sehe
    Sep 15, 2011 at 14:49
  • @sehe: There still is stdio. Sep 15, 2011 at 15:11
  • stdio is a file. In fact, on UNIX, everything is a file. Devicenodes are files. Sockets are files. Pipes are files. So no, it isn't guaranteed that a program will always have access to it's own stdin/stdout - if it even had anything (besides /dev/null) allocated to them in the first place.
    – sehe
    Sep 15, 2011 at 15:16

2 Answers 2

0

What you want is best accomplished with mandatory access control like AppArmor. Some sort of MAC is included in almost every distro nowadays, but usually with fairly liberal permissions, so you add your own customized restrictions according to your own needs.

3

Look at

  • chroot jails (schroot is popular)
  • UML (somewhat more complicated)

To really restrict access to periperals full/hypervised virtualization is required.

  • qemu/qemu-kvm for full isolation

Using debootstrap (for debian based distributions) will be a good starting point

PS. BSD and Solaris natively support zones/containers that do precisely this type of isolation. Solaris is no doubt superior (with complete virtualized networking subsystem call Crossbow) but unfortunately, Oracle killed the OpenSolaris distribution.

You should be able to get something going based on Nexenta (Debian userland on Solaris kernel) or IllumOS (fork based on latest OpenSolaris published), but I expect BSD to be closer to the linux experience.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .