New answers tagged

0

You may want to look into grid computing systems. In particular, BOINC (http://boinc.berkeley.edu) checks almost all of your boxes. I believe it operates on your parameters as such: fs: can read/write to its own directory, nowhere else net: can be configured to only allow network access to your BOINC server, but isn't default out of the box IIRC mem: yes,...


4

You don't need to be root to start a user-scoped group with systemd-run: $ systemd-run --user --scope /bin/bash Running scope as unit run-23318.scope. $ sleep 999 & [1] 23369 You can see the unit: $ systemctl --user status run-23318.scope * run-23318.scope - /bin/bash Loaded: loaded (/run/user/1000/systemd/user/run-23318.scope; static; ...


0

seccomp-bpf is another option which works well for OpenSSH, vsftpd and Chromium it only has exit(), sigreturn(), read() it does also use write() although it allows filtering of system calls using configurable Berkeley Packet Filter rules. It could also be used in conjunction with cgroups for memory, cpu etc... https://wiki.mozilla.org/Security/Sandbox/...



Top 50 recent answers are included