The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
24 views

Sandbox an account and prevent it from any system modifications

I am trying to sandbox a user account to the point where it cannot edit or view any files beyond a certain folder, namely /home/user/test. This account will be compiling and running a C++ program that ...
4
votes
1answer
51 views

How can I test whether Chromium is running inside sandbox

I am using Chromium browser on Debian Wheezy. I read that Chromium is using sandbox to isolate its processes from the rest of the system and thus to increase security. How can I verify that Chromium ...
0
votes
1answer
73 views

Terminal sandbox commands

I was wondering if there's a way to run shell commands that affect only a certain directory and its subdirectories. I'm using PHP and I want to make an app that allows the user to execute shell ...
1
vote
1answer
155 views

Problem running “selinux sandbox” with java

I am trying to sandbox a java application using selinux sandbox. System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop The cmd ...
7
votes
1answer
129 views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
1
vote
1answer
45 views

SELinux Sandbox Usage

What am I doing wrong in the following, from the man file and internet it looks like this is right. $ echo "hello world" 1> test $ sandbox -i test cat test /usr/bin/cat: test: Permission denied
3
votes
2answers
199 views

what are the techniques to extract files safely?

Yesterday I was making some experiments on Slitaz. It uses multiple initrd.img's to store files/changes. I wanted to extract one of its initrd.gz images (which is a cpio archive) to a folder, ...
1
vote
5answers
261 views

override hardcoded paths in executables

I'd like to override some hardcoded paths stored in pre-compiled executables like "/usr/share/nmap/" and redirect them to another dir. My ideal solution should not require root priviledges, so ...
1
vote
2answers
51 views

Automated test for install script

I'm writing an install script for an appliance that modifies system config files under /etc (amongst other things). How can I test this script non-destructively? Ideally I would like to run the ...
0
votes
1answer
56 views

Sandbox alike solution for linux

I wonder if there is a kind of a sandboxing solution for linux, sometimes there is more than one app that is candidate to solve my problems, in that case I want to try all of them to get the one which ...
2
votes
0answers
136 views

How to start aufs for two local directories

I'm trying to create a sandbox for testing an untrusted software. I'm using Debian, I have installed aufs-tools. When I try to mount a minimal example with the following command: mount -t aufs -o ...
0
votes
1answer
88 views

sandboxing approaches [closed]

do you know where to find another comparison between sandboxing approaches like this one? Also, I'd like you guys to explain to me why isn't SELinux or Seccomp included in that table.
4
votes
1answer
107 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
8
votes
2answers
1k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
0
votes
1answer
56 views

What's the state-of-the-art in package “encapsulation” on Linux? [closed]

Is there any general, universal way that if I want to install package Foo or build Foo from source, I can have it do everything, install dependencies, etc, in its own "sandbox" directory without ...
3
votes
3answers
347 views

Launch a process with limited permissions

I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user ...
10
votes
2answers
5k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
4
votes
1answer
955 views

How to run programs in a Sandbox?

I have been using PlayOnLinux to run windows programs on Linux. PlayOnLinux creates a virtual drive for each program installed and every VD represents a different Windows XP computer. Any changes ...
6
votes
2answers
900 views

RLIMIT_NPROC suddenly overwhelmed

In a small script I have, I'm starting a shell and then setting RLIMIT_NPROC on it to some small number, like 5, using prlimit Then, I try to execute a shell script that only contains: #!/bin/bash ...
4
votes
0answers
641 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
4
votes
3answers
321 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
2answers
248 views

start process so that it can't spawn new ones

Is it possible to start new process so that it couldn't spawn new ones (untrusted code)? Also how do I start a process so it couldn't make any input/output to files and in general any devices?
9
votes
2answers
4k views

How to create a snapshot in btrfs, and then rollback to it after some work?

What are the commands to use in btrfs in case I want to: create a (read-only) snapshot of a volume; (do some experiments in the volume); and then rollback the volume to the snapshot?
5
votes
1answer
1k views

Can LVM snapshots be writable? (and used for temporary experiments)

It seems that usually it is talked about snapshots as read-only. (In a scenario where one creates a snapshot, then does some experiments with the main volume, and then restores the old state by ...
11
votes
1answer
4k views

How to create a read-only snapshot in LVM, and then rollback to it after some work?

What are the commands to use in LVM in case I want to: create a read-only snapshot of a volume; (do some experiments in the volume); and then rollback the volume to the snapshot?