Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been using PlayOnLinux to run windows programs on Linux. PlayOnLinux creates a virtual drive for each program installed and every VD represents a different Windows XP computer.

Any changes made by the program stay within its own VD only. So if I run a program with a virus I can simply delete the program's VD and all is well.

Is there a similar program that allows Linux programs to be run in a virtual drive? i.e. I want PlayOnLinux/Wine minus the windows emulation.

share|improve this question
2  
wine is not a sandbox; it just so happens that Windows applications don't try to break out onto the system. – Ignacio Vazquez-Abrams Jan 10 '13 at 7:27

The linux-vserver kernel patch and associated userspace (see http://linux-vserver.org/) allow you to run programs in their own isolated containers without requiring full virtualization of the guest OS.

linux-vserver containers have their own mount namespace, their own network namespace, their own security context etc.

Note though that linux-vserver was designed mostly to run servers; while you can run desktop applications in a linux-vserver container, you'll need to know what you're doing.

Another approach would be to use AppArmor to restrict what your program is allowed to do.

share|improve this answer

I cant give you a full answer since I dont know, but what I do know is that the command chroot is designed for similar if not the exact same purpose.

share|improve this answer
1  
chroot is ok for basic security, but you should know that there are ways to break out of a chroot environment. – Elias Probst Dec 17 '13 at 9:45
    
@EliasProbst oh? I wasnt aware, I am not too familiar with chroot actually – Karthik T Dec 17 '13 at 10:43
    
That @EliasProbst, plus setting up a chroot jail for non-trivial software can be a headache. It depends on exactly what the software does and how it does it. Server software generally does better in chroot jails than user-oriented software (running BIND in a chroot jail isn't so bad, but I wouldn't try running LibreOffice in a chroot jail, for example...) – Michael Kjörling Dec 17 '13 at 12:50
    
Using systemd-nspawn or docker this can be achieved really really easy. Not chroot based, but based on LXC instead which is even slightly more secure than a plain chroot and provides better isolation from the host. – Elias Probst Dec 17 '13 at 14:03

I wanna share Firejail, Sandboxie like software for Linux, GUI included.

Take a look here: https://firejail.wordpress.com/ and download from https://sourceforge.net/projects/firejail/ or https://pkgs.org/debian-sid/debian-main-amd64/firejail_0.9.38-1_amd64.deb.html (change to your system)

Easy of use, just run firejail on top of your command/software, in that case firejail wine program.exe

In case you wanna inspect those programs before run them, you can chain all together using firejail wine winedbg --gdb program.exe to run wine debugger jailed.

Maybe you're thinking of how much good it can be. Take a look on how to fully run a firejailed wordpress installation, as example of a complex sandboxing. https://www.digitalocean.com/community/tutorials/how-to-use-firejail-to-set-up-a-wordpress-installation-in-a-jailed-environment

Never trust a piece of binary blob (exe)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.