I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students are trying to do anything "fun" first).

Most of the assignments should only read their input and produce output. Some might read files on the system. Then I only want it to be able to read world readable files on the system.

Just sandbox assignment.py works fine in some respects, where sandbox is from policycoreutils-python in SElinux sandbox in CentOS 7. Then assignment.py can't write files, access the net, and some other bad things. But it can still read my files.

Actually it can read local files, but not NFS mounted files. With sandbox -t sandbox_min_t I can access NFS mounted files as well (which I want), but the problem is still that the tested program has access to all my files. How can I tell it to only have access to world readable files, or to files only readable by a named user?

(I'm open to using another sandbox available on CentOS, if it's easier to achieve this in some other sandbox.)

(I'd prefer not having to make a new user account just for testing programs. I would prefer not, partly because this might be needed for several teachers/assistants and I want accounts to be personal, and not the user name space being cluttered with lots of these.)

1 Answer 1


A relatively simple sandbox to allow reading and writing already open file descriptors could be implemented using seccomp. A python program initializes the sandbox and then executes the untrusted script. Python bindings added for libseccomp 2.2.0 (LWN) has a generic example how to use libseccomp2 API from Python.

SELinux sandbox can provide a more generic sandbox for running any untrusted application. sandbox command has some useful options which might be enough to prevent access to your files. With -M option, home and temporary directories will be masked with a tmpfs mount, preventing sandbox from accessing underlying files. Together with -i option you can copy the required files into the temporary directory. If your files are not large, it might be simplest just to copy the file in the sandbox. Ideally it would be best to write a custom sandbox domain for your use case.

LXC containers provide another option. However, setting everything up is somewhat large amount of work but the resulting container provides a lot of flexibility. The container could have a read-only filesystem and use a bind mount for writable application directory. Configuration options can be used to prevent the application gaining any new privileges.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .