Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to secure a custom application as much as possible from outside tampering.

I've seen many pages on jailing a user, but they usually include many exceptions, and I want to lock down this user as much as possible.

The user only needs to execute an application that is a websocket++ client & server that needs the ability to:

  • Accept incoming connections port forwarded from 443 to another port, for example 8000
  • Seek outgoing connections
  • Communicate with a local PostgreSQL server
  • Read from & write to a few specific files in the directory where the application is executed
  • Get output from ntpd -c 'rv'
  • Accept keyboard input

How can my intent be implemented?

share|improve this question
up vote 4 down vote accepted

if you really

want to lock down this user as much as possible

create a virtual machine. The chroot don't really isolate this process.

If a real virtual machine is too heavy, maybe you can have a look at linux containers, a lightweight version of virtual machine. Harder to configure though.

If you want something even more lightweight you can try to configure SELinux. Maybe even harder to configure, but it should do exactly what you want

chroot is not intended as a security measure, and there are various way to work around it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.