4

I'm wondering if there is an application that makes it so that commands after it operate in an environment that treats the working directory as if it were the top-most one, and there is absolutely no way to access the wider file system via '..' and such?

2
  • The "app" is "access right" for other folders. To restrict to enter into folder you have to unset x(execute) bit
    – Costas
    Jul 5, 2015 at 10:21
  • You can do this with one of the "Restricted Shells", for example rbash
    – bsd
    Jul 5, 2015 at 10:41

1 Answer 1

8

Looks like you might be looking for chroot.

Note that while something like ../../../../../.. will not escape the restricted root directory, there are other ways to escape indirectly, by leveraging other processes. If you're concerned about a malicious application, run it as a user who doesn't run any process outside the chroot.

For a more advanced/packageable/secure solution, have a look to docker or other container based solutions.

6
  • Could you please explain what you meant by 'packagable' in this context?
    – Rob F
    Jul 5, 2015 at 13:00
  • I mean docker allows you to build and eventually distribute a software package that will run in such a constrained environment.
    – jlliagre
    Jul 5, 2015 at 13:03
  • 1
    use some kind of container or virtulization, else chroot is vulnerable to the likes of ftp.cs.wisc.edu/pub/users/dszafir/escapeCHROOT.c once running with (ch)root privs
    – Skaperen
    Jul 5, 2015 at 13:21
  • 1
    Note that you'll need hard links to all the executables and libraries you need inside the chroot tree.
    – Kevin
    Jul 5, 2015 at 16:34
  • 1
    @Kevin, indeed and that's the reason why I suggested using a container based solution that take care of all of these requirements.
    – jlliagre
    Jul 5, 2015 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.