Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to start new process so that it couldn't spawn new ones (untrusted code)?

Also how do I start a process so it couldn't make any input/output to files and in general any devices?

share|improve this question
It would help answer your question if you gave the OS you need this to work on. In my answer below, three of the four solutions run on only some *ix systems and not others. – Warren Young Aug 25 '11 at 23:16
actually not sure about OS, most likely ubuntu server (10.04) – ren Aug 26 '11 at 9:43
In that case, of the options I gave, your choices are AppArmor and chroot out of the box. You could probably enable SELinux instead or in addition, but since AppArmor more or less directly competes, I don't think that would be a good idea. – Warren Young Aug 26 '11 at 10:52
up vote 2 down vote accepted

This sounds like a job for a Mandatory Access Control system like SELinux or AppArmor.

This article on SELinux will give you some idea of how powerful such systems can be, and the tools you need to develop such policies.

Beware, your wish to restrict access to all files is likely to backfire on you. In Unix "everything is a file," so entirely preventing all file access will prevent your program from even starting. A more productive approach will likely be to restrict file writing, either entirely or to only a specific directory, and to whitelist categories of files the program can legitimately read.

Another option is to use chroot or jails. With these OS features, instead of preventing file I/O or program execution, you would simply build a restricted environment where there is nothing sensitive for your untrusted program to read, write or execute. Your program could only operate on the files you put into the "box" with it.

share|improve this answer

If your system uses pam, create some dedicated untrusted user, and have a look at /etc/security/limits.conf:

#Each line describes a limit for a user in the form:
#<domain>        <type>  <item>  <value>
#<domain> can be:
#        - an user name
#        - a group name, with @group syntax
#<type> can have the two values:
#        - "soft" for enforcing the soft limits
#        - "hard" for enforcing hard limits
#<item> can be one of the following:
#        - core - limits the core file size (KB)
#        - data - max data size (KB)
#        - fsize - maximum filesize (KB)
#        - memlock - max locked-in-memory address space (KB)
#        - nofile - max number of open files
#        - rss - max resident set size (KB)
#        - stack - max stack size (KB)
#        - cpu - max CPU time (MIN)
#        - nproc - max number of processes
#        - as - address space limit (KB)
#        - maxlogins - max number of logins for this user
#        - maxsyslogins - max number of logins on the system
#        - priority - the priority to run user process with
#        - locks - max number of file locks the user can hold
#        - sigpending - max number of pending signals
#        - msgqueue - max memory used by POSIX message queues (bytes)
#        - nice - max nice priority allowed to raise to values: [-20, 19]
#        - rtprio - max realtime priority

You are specifically looking for nproc and maybe nofile. Though, I doubt any program would work with user hard nofile 0. Better adjust the filesystem permissions so that your dedicated user can't access anything you don't want it to access.

Disclaimer: I never used that myself. (I mean the pam stuff. Creating a dedicated untrusted user cannot be bad.)

share|improve this answer
Also after a bit of looking found this: setrlimit(RLIMIT_CPU, ...) – ren Aug 26 '11 at 9:47
@ren: yes, I thought there was a shell wrapper for that, but I couldn't find it. Maybe this was available in ulimit, but the man page won't tell it anymore. – Stéphane Gimenez Aug 26 '11 at 9:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.