Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a service that allows users to submit code which is compiled and executed on the server.

At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some weird issues with other languages such as Perl and PHP on 64 bit.

Is there any secure way to run possibly unsafe code that works properly on 64 bit?

I've had success running all sorts of languages like Perl, Lua and PHP on 32 bit systems in the past with both Moe and my own ptrace based sandbox, but neither work perfectly on 64 bit.

share|improve this question
Can't you do this with a basic chroot? – rahmu Dec 20 '11 at 14:28
QEMU in non-system mode? – Marcin Dec 20 '11 at 14:38
@Marcin I considered that, but performance is critical and KVM isn't available so QEMU or any kind of virtualization is out of the question – anonymous coward Dec 20 '11 at 14:49

A proper security subsystem such as SELinux will allow you to run an executable with restricted or no capabilities, including disk, network, and UI facilities. ulimit will take care of the rest.

share|improve this answer
Could you explain how to set up a fairly restrictive sandbox with SELinux? – anonymous coward Dec 20 '11 at 14:47
Not... in the space of an answer here. But I can tell you that you need to create a new domain and two file contexts, one for the interpreter executable and one for any script and data files it has, then limit the capabilities of the domain to the minimum required set. – Ignacio Vazquez-Abrams Dec 20 '11 at 14:53
@CharlieSomerville, Try this guide: linuxtopia.org/online_books/getting_started_with_SELinux/… – n0pe Dec 20 '11 at 17:00

Maybe you should consider options like:

They differ in capabilities and performance so you should do a little research to find out what's best for your case.

share|improve this answer
I would guess cgroups would be the proper tool, but it's hard to tell from the question. – Philip Durbin Dec 31 '11 at 4:54

As above, SELinux, Tomoyo, or AppArmour. Do a search for MAC (Mandatory Access Controll).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.