Is there any way to change what files (in particular files content) an application can see?

I know you can prevent access to files with DAC or MAC, but I don't want to prevent accessing. Instead, I would like to change the content an application can see. When I access a file using an application, for example, I enter /home/user/.profile on my browser and I don't want the application to see the real content, but instead a spoofed version with the same file path however. If I open the file from the terminal or from some other application it should sees the correct content. Is this somehow possible? Can this be extended to changing the contents for specific users?

  • Maybe you want Linux namespaces. Google it, then do it no matter by lxc-run or lxc-unshare or write your own sandbox. As a question on this website, I think it's too abroad. Commented Sep 13, 2018 at 15:04

1 Answer 1


You can use Linux mount namespaces to set up a modified view on the filesystem. Container frameworks such as LXC use it behind the scenes. It can be used from shell quite easily as well, but requires root access to setup.

unshare -m
mount --make-rprivate /
mount --bind /spoof/x /target/x

Bind mounts are used to hide parts of the original file system tree by mounting over the original paths. mount --make-rprivate prevents any new mounts from propagating between the mount namespaces.

pam_namespace module can be used to configure users in their own mount namespace and configure bind mounts.

  • I'm actually already running in a lxc container. I'm not sure if I can run it nested. The most important paths would be entries under /proc or /sys and I don't know how easy it would be to spoof parts of those without breaking the rest. Background is, I actually want to hide that a container is used.
    – tainted
    Commented Sep 13, 2018 at 16:22
  • Running nested mount namespaces shouldn't be an issue. For limiting /proc or /sys you probably should use MAC (SELinux/AppArmor) or choose not to make them visible for your application (run without /proc and /sys mount points altogether).
    – sebasth
    Commented Sep 13, 2018 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .