Questions tagged [sandbox]
The sandbox tag has no usage guidance.
0
votes
1answer
26 views
pivot_root(2) causes system crash
I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
1
vote
0answers
36 views
Where to find more infos about Xwayland command line options?
My gnome-session starts a Xwayland instance which I can find
$> pgrep -a Xwayland
995 /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6
which shows that ...
2
votes
1answer
53 views
Run a program and see what it changes in the system
I have a closed-source VPN program that messes up my system (Fedora Linux): I run it, it changes something, VPN works, but when I terminate the connection, my system is left in a dirty state and the ...
3
votes
1answer
260 views
firejail : only let a program access localhost
I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.
I am looking for a way to sandbox the client using firejail, in a way ...
1
vote
0answers
67 views
firejail: child-process not sandboxed?
As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me.
My understanding has always been that whenever I start a programm/process in firejail ...
2
votes
4answers
327 views
Create temporary empty environment in Linux [closed]
Is it possible to create a temporary empty environment for a new user in a Shell like Bash or zsh?
I mean like the incognito mode in Chrome which opens an isolated environment in which everything you ...
1
vote
0answers
60 views
How does one grant access to directories with SELinux's sandbox utility?
I'm trying to run Tor Browser Bundle within an SELinux sandbox. I tried to do the following, after looking at man sandbox:
$ sandbox -X -H sehome -T tmp -I /run/user/1000/dbus-1/* \
-t ...
0
votes
0answers
66 views
Subgraph OS: How to get files out of OZ sandbox onto USB?
I downloaded some files through tor on Subgraph OS. Now i want to copy those files to a USB drive. Problem is that tor is running in an OZ sandbox which doesn't seem to let me get the files out of the ...
1
vote
1answer
171 views
How to avoid running make as root in the last step of installing an application from source? [duplicate]
I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
0
votes
1answer
157 views
Mismatched APT Dependencies
I have Synergy installed on Ubuntu 18.04 (this is not the new version 2, fwiw). Apparently, it has a requirement of libcurl3. However, the machine also runs as a hypervisor and I need to use ...
2
votes
2answers
84 views
How can we easily revert the changes made by experiements with unfamiliar commands? [closed]
Sometimes I would like to experiment with some commands which I am unfamiliar with (e.g. xmodmap), and also have the ability to revert the changes very easily without knowing much about the commands ...
1
vote
1answer
59 views
How to properly sandbox a program that may hang the computer
Recently I compiled a program in GNU MIX. The program is rather simple and only contains an unconditional jump to the only instruction, which is essentially a infinite loop.
The problem is, when I ...
3
votes
1answer
248 views
Restrict clipboard for untrusted X11 clients
I've came across this blog https://notehub.org/rp5n2 which describes a way to make certain X11 clients untrusted[1], which makes certain X11 extensions unavailable to them. Note that I know perfectly ...
1
vote
0answers
111 views
Example setup for zita-njbridge in multicast mode?
Do you have a working zita-njbridge triplet of command lines (one n2j, two j2n) proven to run in multicast mode, which you might share?
I'd like to study a working example, to compare to my special ...
3
votes
0answers
245 views
What exactly is Flatpak and why would I want to use it? [closed]
I just noticed that the current update of the distribution I'm using (version 18.3 of Linux Mint) boasts supports for "Flatpak". So, I ddg'ed it and found this Wikipedia page about yet.
So I ...
0
votes
1answer
398 views
Computing sandbox with ptrace inspecting
I want to launch untrusted compute-only executables in linux server. Process will have no access to system and files except stdin and stdout
My idea is to use ptrace to catch and block syscalls to ...
3
votes
3answers
3k views
Merge changes to upper filesystem to lower filesystem in Linux Overlay (OverlayFS) mount
I would like to be able to merge changes from the upper filesystem of an overlay mount to a lower filesystem.
I am interested both online (i.e. merge while the overlay is mounted) and offline (...
0
votes
1answer
88 views
Sandboxing Chrome (or other browser)
I'm wanting to run Chrome with an encrypted home directory (Ubuntu) but I want to make sure that nothing is leaking outside of the encrypted directory, such as /tmp. How might I accomplish this? ...
1
vote
0answers
101 views
Program to track file / directory changes in Linux
I am currently trying to make a sandbox environment that enables me to open potential Phishing e-mails in a safe environment. There are other articles on this in the security stack exchange (https://...
2
votes
0answers
122 views
What is machine-id?
Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
3
votes
1answer
131 views
How to access only world readable files in SElinux sandbox
I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students ...
4
votes
3answers
2k views
How can I “sandbox” a shell script?
I have a shell script like so:
#/bin/sh
#do some stuff
But the interpreter, sh is not in /bin/ but instead in another directory. Similarly, the script creates folders in directories I have no write ...
4
votes
2answers
4k views
why php can not see /tmp files
i have simple test.php page:
<pre><?php system("ls -la /tmp"); ?></pre>
which always shows just: . and .. folders and nothing else in browser.
in the command line:
1) ls -la /...
2
votes
0answers
118 views
How to sandbox JVM on a CentOS [closed]
I'm looking for the best way to sandbox a JVM process running on CentOS. The process must not be allowed to spawn subprocesses, call ptrace or kill, write access should be limited only to specific ...
1
vote
1answer
662 views
Firejail or chroot [closed]
What's the difference between Firejail and chroot in case of security? I mean, should I trust a built-in tool or third-party for sandboxing untrusted applications that could be potentially targeted to ...
0
votes
1answer
517 views
sandbox firejail --overlay
I´ve got a problem with firejail. In principle this sandbox works quite well. I can start a browser (firefox/midori) and other applications as well (like rhythmbox). What I want to do now is use the ...
4
votes
1answer
358 views
Is sandbox-simplify command removed from OS X sierra?
Looks like the sandbox-simplify command is removed in OS X sierra,
I can't find it in system path, only sandbox-exec command is available now.
So, is there any replacements?
1
vote
1answer
401 views
Is there a way to sandbox Wine in OS X?
Wine does not sandbox the applications run therein, and is susceptible to malware.
Is there a way to sandbox Wine in OS X, using some neat solution, perhaps third-party software?
Or, is ...
2
votes
1answer
449 views
Complete isolation in Linux sandboxing
Applications on iOS (and perhaps the ones that are sandboxed on OS X) are confined to a virtual root filesystem that only has the files and directories specific to the application. The root seen by an ...
2
votes
0answers
182 views
Benchmarking under SELinux Sandbox with Phoronix Test Suite
I would like to run the Phoronix Test Suite 6.2.2 under the SELinux sandbox on Fedora 23, but I can't execute it using $ sandbox ./phoronix-test-suite. I probably don't have the correct SELinux type. ...
1
vote
2answers
335 views
Are there sandboxing concepts for proprietary binary kernel modules in linux?
Quite a lot has been going on to advance inter-process security (UID the same) and priveledge dropping in userland, yet it is common that proprietary linux kernel components are used (it seems that ...
1
vote
1answer
1k views
Lock a user with his home folder
Is there any way of making a user only able to see and modificate his home folder? I am currently on arch linux.
Just explaining a little better, the user would not be able to see /etc or any other ...
2
votes
1answer
686 views
Run program in readonly mode
I have an apache running under user apache with a lot of permissions (rw to multiple directories). Now I want to let some users upload programs/scripts via webform and execute them, with php function ...
2
votes
1answer
128 views
Restrict user script execution
I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players.
A player write a bot in Python
Upon validation, the code is sent to the server
A ...
5
votes
1answer
280 views
Sandboxing a binary on linux
I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
2
votes
1answer
114 views
Sandbox an account and prevent it from any system modifications
I am trying to sandbox a user account to the point where it cannot edit or view any files beyond a certain folder, namely /home/user/test. This account will be compiling and running a C++ program that ...
4
votes
1answer
2k views
How can I test whether Chromium is running inside sandbox
I am using Chromium browser on Debian Wheezy. I read that Chromium is using sandbox to isolate its processes from the rest of the system and thus to increase security.
How can I verify that Chromium ...
0
votes
1answer
1k views
Terminal sandbox commands
I was wondering if there's a way to run shell commands that affect only a certain directory and its subdirectories.
I'm using PHP and I want to make an app that allows the user to execute shell ...
1
vote
1answer
796 views
Problem running “selinux sandbox” with java
I am trying to sandbox a java application using selinux sandbox.
System details: Redhat 6 | x86_64 | no x server install | jdk7 from oracle tar.gz version | cgred and cgconfig are stop
The cmd ...
14
votes
4answers
2k views
Simplest possible secure sandboxing (limited resources needed)
I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated.
Each node is an instance of an ...
1
vote
1answer
121 views
SELinux Sandbox Usage
What am I doing wrong in the following, from the man file and internet it looks like this is right.
$ echo "hello world" 1> test
$ sandbox -i test cat test
/usr/bin/cat: test: Permission denied
4
votes
2answers
1k views
what are the techniques to extract files safely?
Yesterday I was making some experiments on Slitaz. It uses multiple initrd.img's to store files/changes.
I wanted to extract one of its initrd.gz images (which is a cpio archive) to a folder, edit/...
1
vote
5answers
988 views
override hardcoded paths in executables
I'd like to override some hardcoded paths stored in pre-compiled executables like "/usr/share/nmap/" and redirect them to another dir.
My ideal solution should not require root priviledges, so ...
2
votes
2answers
322 views
Automated test for install script
I'm writing an install script for an appliance that modifies system config files under /etc (amongst other things). How can I test this script non-destructively?
Ideally I would like to run the ...
0
votes
2answers
93 views
Sandbox alike solution for linux
I wonder if there is a kind of a sandboxing solution for linux, sometimes there is more than one app that is candidate to solve my problems, in that case I want to try all of them to get the one which ...
3
votes
0answers
292 views
How to start aufs for two local directories
I'm trying to create a sandbox for testing an untrusted software. I'm using Debian, I have installed aufs-tools.
When I try to mount a minimal example with the following command:
mount -t aufs -o ...
0
votes
1answer
175 views
sandboxing approaches [closed]
do you know where to find another comparison between sandboxing approaches like this one?
Also, I'd like you guys to explain to me why isn't SELinux or Seccomp included in that table.
5
votes
1answer
276 views
Is strace a suitable tool for finding out where a program wrote to the filesystem?
I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
9
votes
2answers
3k views
LXC containers as a sandbox environment
I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
1
vote
1answer
91 views
What's the state-of-the-art in package “encapsulation” on Linux? [closed]
Is there any general, universal way that if I want to install package Foo or build Foo from source, I can have it do everything, install dependencies, etc, in its own "sandbox" directory without ...
