I am creating a web app similar to codepad and for each run-action my app copies a directory (/home/radeks/voidptr/private/chroot-root) to /tmp/voidptr/[random-id]/chroot-root. This chroot directory has a user that compiles and runs the code entered by the web app user. The problem is that I don't want the user to shut down the machine or use sockets for example.

Do I need to write a supervisor or can I simply set these permissions per user?


Chroot only restricts filesystem access. If you have root permissions, a chroot is merely an inconvenience, not a secure confinement. Ordinary users can use sockets but not shut down the machine.

There are ways to restrict what users can do: capabilities, AppArmor, SELinux, … But by far the easiest way is to confine the webapp user to a virtual machine. You will easily be able to restrict things like network connectivity and resource usage. For your use case, a lightweight Linux-on-Linux vm technology seems best: something like OpenVZ, user-mode Linux or Vserver.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.