The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
143 views

what are the techniques to extract files safely?

Yesterday I was making some experiments on Slitaz. It uses multiple initrd.img's to store files/changes. I wanted to extract one of its initrd.gz images (which is a cpio archive) to a folder, ...
1
vote
5answers
180 views

override hardcoded paths in executables

I'd like to override some hardcoded paths stored in pre-compiled executables like "/usr/share/nmap/" and redirect them to another dir. My ideal solution should not require root priviledges, so ...
1
vote
2answers
46 views

Automated test for install script

I'm writing an install script for an appliance that modifies system config files under /etc (amongst other things). How can I test this script non-destructively? Ideally I would like to run the ...
0
votes
1answer
52 views

Sandbox alike solution for linux

I wonder if there is a kind of a sandboxing solution for linux, sometimes there is more than one app that is candidate to solve my problems, in that case I want to try all of them to get the one which ...
2
votes
0answers
95 views

How to start aufs for two local directories

I'm trying to create a sandbox for testing an untrusted software. I'm using Debian, I have installed aufs-tools. When I try to mount a minimal example with the following command: mount -t aufs -o ...
0
votes
1answer
68 views

sandboxing approaches [closed]

do you know where to find another comparison between sandboxing approaches like this one? Also, I'd like you guys to explain to me why isn't SELinux or Seccomp included in that table.
4
votes
1answer
86 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
7
votes
2answers
768 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
0
votes
1answer
48 views

What's the state-of-the-art in package “encapsulation” on Linux? [closed]

Is there any general, universal way that if I want to install package Foo or build Foo from source, I can have it do everything, install dependencies, etc, in its own "sandbox" directory without ...
3
votes
3answers
253 views

Launch a process with limited permissions

I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user ...
8
votes
2answers
4k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
3
votes
1answer
726 views

How to run programs in a Sandbox?

I have been using PlayOnLinux to run windows programs on Linux. PlayOnLinux creates a virtual drive for each program installed and every VD represents a different Windows XP computer. Any changes ...
6
votes
2answers
761 views

RLIMIT_NPROC suddenly overwhelmed

In a small script I have, I'm starting a shell and then setting RLIMIT_NPROC on it to some small number, like 5, using prlimit Then, I try to execute a shell script that only contains: #!/bin/bash ...
3
votes
0answers
572 views

How do I set up the SELinux sandbox in Debian?

I've installed SELinux in Debian sid in order to use the sandbox that locks down apps to a restricted enviroment, but I can't get it to work. If I try to use the sandbox command in permissive mode ...
4
votes
3answers
291 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
2answers
243 views

start process so that it can't spawn new ones

Is it possible to start new process so that it couldn't spawn new ones (untrusted code)? Also how do I start a process so it couldn't make any input/output to files and in general any devices?
8
votes
2answers
3k views

How to create a snapshot in btrfs, and then rollback to it after some work?

What are the commands to use in btrfs in case I want to: create a (read-only) snapshot of a volume; (do some experiments in the volume); and then rollback the volume to the snapshot?
5
votes
1answer
961 views

Can LVM snapshots be writable? (and used for temporary experiments)

It seems that usually it is talked about snapshots as read-only. (In a scenario where one creates a snapshot, then does some experiments with the main volume, and then restores the old state by ...
11
votes
1answer
3k views

How to create a read-only snapshot in LVM, and then rollback to it after some work?

What are the commands to use in LVM in case I want to: create a read-only snapshot of a volume; (do some experiments in the volume); and then rollback the volume to the snapshot?