Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am creating a web app similar to codepad and for each run-action my app copies a directory (/home/radeks/voidptr/private/chroot-root) to /tmp/voidptr/[random-id]/chroot-root. This chroot directory has a user that compiles and runs the code entered by the web app user. The problem is that I don't want the user to shut down the machine or use sockets for example.

Do I need to write a supervisor or can I simply set these permissions per user?

share|improve this question

Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine.

There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You will easily be able to restrict things like network connectivity and resource usage. For your use case, a lightweight Linux-on-Linux vm technology seems best: something like OpenVZ, user-mode Linux or Vserver.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.