0

I use Gentoo Linux. I need to find out what the program running under root downloads and where it puts the downloaded files. I would also like to have a sandbox for testing programs from unreliable sources.

In particular, when installing the hplip driver, it downloads the plugin over the network. I would like to know which file it downloads and what changes it makes in the environment.

Please advise a sandbox program for Linux that would

  1. It would allow you to run programs in a virtual environment.
  2. It would use the current system configuration, i.e. that running programs in the sandbox would be identical to running outside the sandbox.
  3. It would show which files were added or changed.
  4. It would allow you to approve or reject changes if necessary. Like a commit in svn.
  5. Different from VirtualBox and Vmware because they do not meet points 2-4

I tried to use firejail, but it does not contain points 3 and 4. I also tried to use the sandbox, it similarly failed to implement point 3 and 4. strace helps you keep track of all created and modified files, but unfortunately, it does not allow you to roll back changes.

In general, the most satisfying requirement of the mbox program is https://pdos.csail.mit.edu/archive/mbox/. But unfortunately it is not in the Gentoo repository. At least I couldn't find it.

1 Answer 1

1
  1. It would allow you to run programs in a virtual environment.
  2. It would use the current system configuration, i.e. that running programs in the sandbox would be identical to running outside the sandbox.
  3. It would show which files were added or changed.

What you'd describe would be implemented with a readonly rootfs, and an overlayfs which you can inspect afterwards. Or, even simpler, put your rootfs on btrfs, or ZFS, or on a filesystem on a thin LVM pool, and make a snapshot before installing the dubious software. You can then later on mount the snapshot and compare it with the state of your actual root.

However, much more sensible in terms of isolation is running your software in a container. These things were literally made to support "immutable" base images with changes on top – and it's thus easy to look at the changes alone.

  1. It would allow you to approve or reject changes if necessary. Like a commit in svn.

SVN, oldschool! Well, you can of course selectively copy the changed files from the overlay to the permanent storage after the fact. If you worked with filesystem snapshots, rsync --delete is excellent to restore previous states selectively.

1
  • It looks like overlayFS is what I need, but there is a problem. I've been experimenting with mount -t overlay overlay -o lowerdir=/lower,upperdir=/upper,workdir=/work /merged. Everything is fine, everything seems to be done that I need. But when I try to merged the root fs with /upper mount -t overlay overlay -o lowerdir=/,upperdir=/upper,workdir=/work /merge, an error is returned. mount: /merged mount(2) system call failed: Too many levels of symbolic links. Is it possible to do something about it, or is the root FS too big for this? Jun 29, 2021 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .