Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm running a service that allows users to submit code which is compiled and executed on the server.

At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some weird issues with other languages such as Perl and PHP on 64 bit.

Is there any secure way to run possibly unsafe code that works properly on 64 bit?

I've had success running all sorts of languages like Perl, Lua and PHP on 32 bit systems in the past with both Moe and my own ptrace based sandbox, but neither work perfectly on 64 bit.

share|improve this question
Can't you do this with a basic chroot? – rahmu Dec 20 '11 at 14:28
QEMU in non-system mode? – Marcin Dec 20 '11 at 14:38
@Marcin I considered that, but performance is critical and KVM isn't available so QEMU or any kind of virtualization is out of the question – Charlie Somerville Dec 20 '11 at 14:49

3 Answers

up vote 4 down vote

A proper security subsystem such as SELinux will allow you to run an executable with restricted or no capabilities, including disk, network, and UI facilities. ulimit will take care of the rest.

share|improve this answer
Could you explain how to set up a fairly restrictive sandbox with SELinux? – Charlie Somerville Dec 20 '11 at 14:47
Not... in the space of an answer here. But I can tell you that you need to create a new domain and two file contexts, one for the interpreter executable and one for any script and data files it has, then limit the capabilities of the domain to the minimum required set. – Ignacio Vazquez-Abrams Dec 20 '11 at 14:53
@CharlieSomerville, Try this guide: linuxtopia.org/online_books/getting_started_with_SELinux/… – MaxMackie Dec 20 '11 at 17:00
up vote 1 down vote

Maybe you should consider options like:

They differ in capabilities and performance so you should do a little research to find out what's best for your case.

share|improve this answer
1  
I would guess cgroups would be the proper tool, but it's hard to tell from the question. – Philip Durbin Dec 31 '11 at 4:54
up vote 0 down vote

As above, SELinux, Tomoyo, or AppArmour. Do a search for MAC (Mandatory Access Controll).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.