Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite
1

So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to some good reading resource, since from what I've found there aren't too many.

share|improve this question
2  
have you looked at pypi.python.org/pypi/pysandbox? pysandbox may give you the flexibility you want to deny filesystem writes. – Tim Kennedy Oct 4 '11 at 20:07
Does it still need read permissions for stuff? @Tim Kennedy's answer is a good place. The more app-type agnostic way to do this is using chroot, and just putting it in a directory it has no write permissions to (how named works). – polynomial Oct 6 '11 at 3:05
well, after all I ended up doing this with apparmor... – ren Oct 8 '11 at 10:50

1 Answer

up vote 3 down vote accepted

Under every OS, it's quite hard to do this, at the moment. Chrome developers have made some progess in this area, but it's still hard. They came with a solution about 22k lines of code (LOC) for Win* systems and 11k LOC for Linux.

In recent news, FreeBSD 9.0 was announced with Capsicum, a framework designed for this purpose, but it can work only on *BSD systems.

On Linux, you can avoid SELinux or AppArmor using seccomp. See this LWN article for more details and sample usage. But it's really hard: it's an all or nothing feature for system calls like read or write.

There is currently a new approach on-going in the LKML, using Berkeley Packet Filter, see this post of Will Drewry.

share|improve this answer
Lots of interesting stuff. I found rather easy way out: setrlimit system call. Parent sets setrlimit(RLIMIT_FSIZE, 0) and all its children are unable to write non-zero sized files. They are unable to do something like setrlimit(RLIMIT_FSIZE, non-zero) as well, so this seems rather secure. I've used it to be able to run user-submitted code, here is an example: rextester – ren Jan 17 '12 at 18:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.