Tag Info

How about creating an empty chroot, then bind-mount the main filesystem as read-only inside the chroot? Should probably be something like this to create a read-only bind-mount: mount --bind /foo/ /path/to/chroot/ mount -o remount,ro /path/to/chroot/ You can bind-mount other directories which you want the jail to have write access to as well. Be careful ...

File system capabilities in Linux were added to allow more fine-grained control than setuid alone will allow. With setuid it's a full escalation of effective privileges to the user (typically root). The capabilities(7) manpage provides the following description: For the purpose of performing permission checks, traditional Unix implementations ...

A virtual machine would make it possible for the script to write anywhere without affecting the host system, and to inspect where it's actually trying to write to, which seem to be the goals. For example, you can easily start up Arch Linux with kvm -boot d -m 512 -cdrom archlinux-*.iso

You could run it in a chroot, mounting special versions of /tmp and such inside. Perhaps systemd is of help, and particularly systemd-nspawn(1), which looks just like what you want.

The simplest solution is probably a wrapper program that creates a new filesystem namespace with the relevant filesystems mounted read-only and then execs the program you are trying to restrict. This is what systemd does when you use ReadOnlyDirectories= to mark certain directories as read-only for a service. There is also an unshare command in util-linux ...