4

I'm wondering if there is an application that makes it so that commands after it operate in an environment that treats the working directory as if it were the top-most one, and there is absolutely no way to access the wider file system via '..' and such?

  • The "app" is "access right" for other folders. To restrict to enter into folder you have to unset x(execute) bit – Costas Jul 5 '15 at 10:21
  • You can do this with one of the "Restricted Shells", for example rbash – bsd Jul 5 '15 at 10:41
8

Looks like you might be looking for chroot.

Note that while something like ../../../../../.. will not escape the restricted root directory, there are other ways to escape indirectly, by leveraging other processes. If you're concerned about a malicious application, run it as a user who doesn't run any process outside the chroot.

For a more advanced/packageable/secure solution, have a look to docker or other container based solutions.

| improve this answer | |
  • Could you please explain what you meant by 'packagable' in this context? – Rob F Jul 5 '15 at 13:00
  • I mean docker allows you to build and eventually distribute a software package that will run in such a constrained environment. – jlliagre Jul 5 '15 at 13:03
  • 1
    use some kind of container or virtulization, else chroot is vulnerable to the likes of ftp.cs.wisc.edu/pub/users/dszafir/escapeCHROOT.c once running with (ch)root privs – Skaperen Jul 5 '15 at 13:21
  • 1
    Note that you'll need hard links to all the executables and libraries you need inside the chroot tree. – Kevin Jul 5 '15 at 16:34
  • 1
    @Kevin, indeed and that's the reason why I suggested using a container based solution that take care of all of these requirements. – jlliagre Jul 5 '15 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.