Say I've got a program mysterion the execution of which will probably modify some files. In order to figure out whether this is harmful or not I'd like to run it in such a way that I can at the very least know which files got modified how, or maybe even somehow hook another program to it that decides whether to accept or deny those change before they even happen. Can that be achieved somehow less tedious than a step-by-step debugging?

Sure enough for the "determine changes" part I could snapshot the entire filesystem and diff it afterwards, but that would probably be like braking a nut with a sledgehammer...


The monitoring part (without the sandboxing) can be accompilshed by simply running

strace -o file.log -e trace=file /path/to/your/binary

Of course, this is a little 'chatty'. So you may have to postprocess a little bit. strace usually comes in a package of the same name. There's also a special 64 bit version.

  • 1
    Neat, and with -p PID one can even attach it to an already running process – Tobias Kienzler Nov 13 '13 at 10:56

You could use something like Systrace which will allow you to run the program in a sandbox with no privileges. You can then use ptrace to see what filehandles the program is trying to open.

Your other option, if you're using SELinux, is to use the SELinux Sandbox. From there you can limit what files it can open, make it so that it cannot open files at all, etc.

I imagine there's a way to accomplish these things with AppArmor, but unfortunately I don't have any familiarity with AppArmor to be able to provide any meaningful suggestions.

  • Keep in mind that an application may try to detect a sandbox environment and behave differently in such cases. – scai Nov 13 '13 at 8:27
  • Can you explain to me how an application would go about detecting an SELinux sandbox environment? I can think of no way an application could be aware that it was in this environment, unless it just behaves differently if SELinux is enabled. – Franz Kafka Nov 13 '13 at 8:36
  • There are lots of things it could check. Sandbox environments usually provide only limited privileges. So it could just check for certain privileges that are completely independent from the bad things it actually wants to do. – scai Nov 13 '13 at 8:42
  • That doesn't really help. You can set up an SELinux Sandbox environment in such a way that the user determines what privs the program has, dynamically. In essence, there is no real difference between this and your regular environment. Therefore, out of interest, I am wondering exactly how a program can detect that it is in this environment, since you've stated that it can. (I'm actually asking for some code here.) – Franz Kafka Nov 13 '13 at 9:57
  • No, I just stated that it may try to detect a sandbox environment. I didn't even state anything about SELinux which has just been one of your examples among others. The important information here is just that an application may behave differently in a modified environment and that you cannot predict its behavior for your actual environment without knowing the source code. – scai Nov 13 '13 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.