I'm running a service that allows users to submit code which is compiled and executed on the server.

At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some weird issues with other languages such as Perl and PHP on 64 bit.

Is there any secure way to run possibly unsafe code that works properly on 64 bit?

I've had success running all sorts of languages like Perl, Lua and PHP on 32 bit systems in the past with both Moe and my own ptrace based sandbox, but neither work perfectly on 64 bit.

  • Can't you do this with a basic chroot?
    – rahmu
    Dec 20 '11 at 14:28
  • QEMU in non-system mode?
    – Marcin
    Dec 20 '11 at 14:38
  • @Marcin I considered that, but performance is critical and KVM isn't available so QEMU or any kind of virtualization is out of the question Dec 20 '11 at 14:49

A proper security subsystem such as SELinux will allow you to run an executable with restricted or no capabilities, including disk, network, and UI facilities. ulimit will take care of the rest.

  • Could you explain how to set up a fairly restrictive sandbox with SELinux? Dec 20 '11 at 14:47
  • Not... in the space of an answer here. But I can tell you that you need to create a new domain and two file contexts, one for the interpreter executable and one for any script and data files it has, then limit the capabilities of the domain to the minimum required set. Dec 20 '11 at 14:53
  • @CharlieSomerville, Try this guide: linuxtopia.org/online_books/getting_started_with_SELinux/…
    – n0pe
    Dec 20 '11 at 17:00

Maybe you should consider options like:

They differ in capabilities and performance so you should do a little research to find out what's best for your case.

  • 1
    I would guess cgroups would be the proper tool, but it's hard to tell from the question. Dec 31 '11 at 4:54

As above, SELinux, Tomoyo, or AppArmour. Do a search for MAC (Mandatory Access Controll).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.