Launch a process with limited permissions





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}







4















I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user area. For example, if I get a package from some colleague who has a tendency to write overly intrusive installers, I could do something like this: 



> subdo make


would run make in such that it wouldn't be allowed to touch any parent directories. Does any such functionality exist in Unix?






command-line permissions sandbox







share|improve this question


















  • 1





    You are looking for chroot, also called "BSD-jails".

    – Johan
    Jun 29 '13 at 16:04


















4















I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user area. For example, if I get a package from some colleague who has a tendency to write overly intrusive installers, I could do something like this: 



> subdo make


would run make in such that it wouldn't be allowed to touch any parent directories. Does any such functionality exist in Unix?






command-line permissions sandbox







share|improve this question


















  • 1





    You are looking for chroot, also called "BSD-jails".

    – Johan
    Jun 29 '13 at 16:04














4












4








4








I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user area. For example, if I get a package from some colleague who has a tendency to write overly intrusive installers, I could do something like this: 



> subdo make


would run make in such that it wouldn't be allowed to touch any parent directories. Does any such functionality exist in Unix?






command-line permissions sandbox







share|improve this question














I'd like to be able to launch processes with very limited permissions from the command line, basically so that I can run a process that I don't understand without it having access to things in my user area. For example, if I get a package from some colleague who has a tendency to write overly intrusive installers, I could do something like this: 



> subdo make


would run make in such that it wouldn't be allowed to touch any parent directories. Does any such functionality exist in Unix?






command-line permissions sandbox




command-line permissions sandbox






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Jun 29 '13 at 15:42









ShepShep

336147




336147








  • 1





    You are looking for chroot, also called "BSD-jails".

    – Johan
    Jun 29 '13 at 16:04














  • 1





    You are looking for chroot, also called "BSD-jails".

    – Johan
    Jun 29 '13 at 16:04








1




1





You are looking for chroot, also called "BSD-jails".

– Johan
Jun 29 '13 at 16:04





You are looking for chroot, also called "BSD-jails".

– Johan
Jun 29 '13 at 16:04










3 Answers
3






active

oldest

votes


















1














The simplest way is to use the nobody account:



sudo -u nobody make


nobody should never have permission to write to anything other than world writable files.






share|improve this answer































    1















    would run make in such that it wouldn't be allowed to touch any parent directories.




    This basically describes chroot:




    • http://en.wikipedia.org/wiki/Chroot

    • https://wiki.archlinux.org/index.php/Change_Root


    Note that, however, when you chroot the process will not have access to anything except the folders under the new root. That means that e.g. if the process needs to run some programs from e.g. /usr/bin or e.g. load some shared libraries from /usr/lib, it won't be able to do that unless you actually copy these under the new root. It really depends on the program you are trying to run.



    You can find a lot of tutorials for different programs, e.g. here's a sample BIND chroot tutorial:




    • http://www.tldp.org/HOWTO/Chroot-BIND8-HOWTO-2.html






    share|improve this answer





















    • 1





      Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

      – Gilles
      Jun 29 '13 at 23:26











    • Agree, thanks for the additional info Gilles!

      – icyrock.com
      Jul 1 '13 at 0:13



















    0














    en.wikipedia.org: Systrace



    OpenBsd man page



    Generate policy:



    systrace -A -d /etc/systrace/make.policy/ 
    
         -E /var/log/systrace_make.log make


    Edit policy with your favorite text editor:



    vi /etc/systrace/make.policy/


    Thereafter, launch process with restrictions:



    systrace -a -d /etc/systrace/make.policy/ 
    
         -E /var/log/systrace_make.log make


    Look at my another one answer about using systrace with sshd






    share|improve this answer


























    • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

      – manatwork
      Jul 6 '13 at 16:07











    • I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

      – stackexchanger
      Jul 6 '13 at 16:10














    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "106"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f81146%2flaunch-a-process-with-limited-permissions%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    3 Answers
    3






    active

    oldest

    votes








    3 Answers
    3






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    The simplest way is to use the nobody account:



    sudo -u nobody make


    nobody should never have permission to write to anything other than world writable files.






    share|improve this answer




























      1














      The simplest way is to use the nobody account:



      sudo -u nobody make


      nobody should never have permission to write to anything other than world writable files.






      share|improve this answer


























        1












        1








        1







        The simplest way is to use the nobody account:



        sudo -u nobody make


        nobody should never have permission to write to anything other than world writable files.






        share|improve this answer













        The simplest way is to use the nobody account:



        sudo -u nobody make


        nobody should never have permission to write to anything other than world writable files.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Jun 30 '13 at 6:45









        bahamatbahamat

        24.9k15090




        24.9k15090

























            1















            would run make in such that it wouldn't be allowed to touch any parent directories.




            This basically describes chroot:




            • http://en.wikipedia.org/wiki/Chroot

            • https://wiki.archlinux.org/index.php/Change_Root


            Note that, however, when you chroot the process will not have access to anything except the folders under the new root. That means that e.g. if the process needs to run some programs from e.g. /usr/bin or e.g. load some shared libraries from /usr/lib, it won't be able to do that unless you actually copy these under the new root. It really depends on the program you are trying to run.



            You can find a lot of tutorials for different programs, e.g. here's a sample BIND chroot tutorial:




            • http://www.tldp.org/HOWTO/Chroot-BIND8-HOWTO-2.html






            share|improve this answer





















            • 1





              Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

              – Gilles
              Jun 29 '13 at 23:26











            • Agree, thanks for the additional info Gilles!

              – icyrock.com
              Jul 1 '13 at 0:13
















            1















            would run make in such that it wouldn't be allowed to touch any parent directories.




            This basically describes chroot:




            • http://en.wikipedia.org/wiki/Chroot

            • https://wiki.archlinux.org/index.php/Change_Root


            Note that, however, when you chroot the process will not have access to anything except the folders under the new root. That means that e.g. if the process needs to run some programs from e.g. /usr/bin or e.g. load some shared libraries from /usr/lib, it won't be able to do that unless you actually copy these under the new root. It really depends on the program you are trying to run.



            You can find a lot of tutorials for different programs, e.g. here's a sample BIND chroot tutorial:




            • http://www.tldp.org/HOWTO/Chroot-BIND8-HOWTO-2.html






            share|improve this answer





















            • 1





              Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

              – Gilles
              Jun 29 '13 at 23:26











            • Agree, thanks for the additional info Gilles!

              – icyrock.com
              Jul 1 '13 at 0:13














            1












            1








            1








            would run make in such that it wouldn't be allowed to touch any parent directories.




            This basically describes chroot:




            • http://en.wikipedia.org/wiki/Chroot

            • https://wiki.archlinux.org/index.php/Change_Root


            Note that, however, when you chroot the process will not have access to anything except the folders under the new root. That means that e.g. if the process needs to run some programs from e.g. /usr/bin or e.g. load some shared libraries from /usr/lib, it won't be able to do that unless you actually copy these under the new root. It really depends on the program you are trying to run.



            You can find a lot of tutorials for different programs, e.g. here's a sample BIND chroot tutorial:




            • http://www.tldp.org/HOWTO/Chroot-BIND8-HOWTO-2.html






            share|improve this answer
















            would run make in such that it wouldn't be allowed to touch any parent directories.




            This basically describes chroot:




            • http://en.wikipedia.org/wiki/Chroot

            • https://wiki.archlinux.org/index.php/Change_Root


            Note that, however, when you chroot the process will not have access to anything except the folders under the new root. That means that e.g. if the process needs to run some programs from e.g. /usr/bin or e.g. load some shared libraries from /usr/lib, it won't be able to do that unless you actually copy these under the new root. It really depends on the program you are trying to run.



            You can find a lot of tutorials for different programs, e.g. here's a sample BIND chroot tutorial:




            • http://www.tldp.org/HOWTO/Chroot-BIND8-HOWTO-2.html







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited 3 hours ago









            Rui F Ribeiro

            41.9k1483142




            41.9k1483142










            answered Jun 29 '13 at 16:13









            icyrock.comicyrock.com

            49836




            49836








            • 1





              Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

              – Gilles
              Jun 29 '13 at 23:26











            • Agree, thanks for the additional info Gilles!

              – icyrock.com
              Jul 1 '13 at 0:13














            • 1





              Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

              – Gilles
              Jun 29 '13 at 23:26











            • Agree, thanks for the additional info Gilles!

              – icyrock.com
              Jul 1 '13 at 0:13








            1




            1





            Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

            – Gilles
            Jun 29 '13 at 23:26





            Note that chroot is only useful against cooperative programs. A malicious program can easily escape the chroot unless you take a lot of extra precautions. For starters, there must be no process that the chrooted process can ptrace (so no process running as the same user outside the chroot, or non-parent ptrace disabled). Other bad things the chrooted process can do include network access (disable it for that user with iptables -m owner --uid-owner …), fork bombs (set stringent limits), etc.

            – Gilles
            Jun 29 '13 at 23:26













            Agree, thanks for the additional info Gilles!

            – icyrock.com
            Jul 1 '13 at 0:13





            Agree, thanks for the additional info Gilles!

            – icyrock.com
            Jul 1 '13 at 0:13











            0














            en.wikipedia.org: Systrace



            OpenBsd man page



            Generate policy:



            systrace -A -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Edit policy with your favorite text editor:



            vi /etc/systrace/make.policy/


            Thereafter, launch process with restrictions:



            systrace -a -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Look at my another one answer about using systrace with sshd






            share|improve this answer


























            • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

              – manatwork
              Jul 6 '13 at 16:07











            • I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

              – stackexchanger
              Jul 6 '13 at 16:10


















            0














            en.wikipedia.org: Systrace



            OpenBsd man page



            Generate policy:



            systrace -A -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Edit policy with your favorite text editor:



            vi /etc/systrace/make.policy/


            Thereafter, launch process with restrictions:



            systrace -a -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Look at my another one answer about using systrace with sshd






            share|improve this answer


























            • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

              – manatwork
              Jul 6 '13 at 16:07











            • I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

              – stackexchanger
              Jul 6 '13 at 16:10
















            0












            0








            0







            en.wikipedia.org: Systrace



            OpenBsd man page



            Generate policy:



            systrace -A -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Edit policy with your favorite text editor:



            vi /etc/systrace/make.policy/


            Thereafter, launch process with restrictions:



            systrace -a -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Look at my another one answer about using systrace with sshd






            share|improve this answer















            en.wikipedia.org: Systrace



            OpenBsd man page



            Generate policy:



            systrace -A -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Edit policy with your favorite text editor:



            vi /etc/systrace/make.policy/


            Thereafter, launch process with restrictions:



            systrace -a -d /etc/systrace/make.policy/ 
            
         -E /var/log/systrace_make.log make


            Look at my another one answer about using systrace with sshd







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Apr 13 '17 at 12:36









            Community♦

            1




            1










            answered Jul 6 '13 at 15:20









            stackexchangerstackexchanger

            28514




            28514













            • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

              – manatwork
              Jul 6 '13 at 16:07











            • I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

              – stackexchanger
              Jul 6 '13 at 16:10





















            • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

              – manatwork
              Jul 6 '13 at 16:07











            • I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

              – stackexchanger
              Jul 6 '13 at 16:10



















            While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

            – manatwork
            Jul 6 '13 at 16:07





            While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

            – manatwork
            Jul 6 '13 at 16:07













            I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

            – stackexchanger
            Jul 6 '13 at 16:10







            I will explain now how to use systrace, better. But anyway, wikipedia links, while openbsd and linux keep using systrace, should not be changed.

            – stackexchanger
            Jul 6 '13 at 16:10




















            draft saved

            draft discarded




















































            Thanks for contributing an answer to Unix & Linux Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid …



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f81146%2flaunch-a-process-with-limited-permissions%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            CARDNET

            Image
            CARDNET は日本カードネットワークが運営するクレジット決済ネットワーク。日本カードネットワークの略称としてもCARDNETが使用されている。 事件・事故 2017年4月15日午前11時8分からクレジットカードの決済がしづらくなる障害が発生した。障害は同日午後5時18分に復旧した。原因は、複数あるCARDNETセンターの拠点のうち1つで、2重化してあるL3スイッチの片方が故障し、1系統にトラフィックが集中したことによる輻輳が発生したため。対処としては、故障したL3スイッチ交換とシステム再起動が行われた [1] 。 出典 ^ 金子寛人 ( 2017年4月17日 ). “CARDNETのクレジット決済に6時間強障害、原因はL3スイッチ故障”. 日経コンピュータ. 2018年10月18日 閲覧。 この項目は、コンピュータに関連した 書きかけの項目 です。この項目を加筆・訂正などしてくださる協力者を求めています（PJ:コンピュータ/P:コンピュータ）。 この項目は、経済に関連した 書きかけの項目 です。この項目を加筆・訂正などしてくださる協力者を求めています（ポータル 経済学、プロジェクト 経済）。 This page is only for reference, If you need detailed information, please check here
            Read more

            Boot-repair Failure: Unable to locate package grub-common:i386

            Image
            0 I am on a system dual-booting Windows and Debian (usually using the latter), and a recent Windows update appears to have wreaked havoc on the Debian boot system. I managed to boot Windows again, but not Linux. Following online suggestions, I created a Live USB of Ubuntu, and booted from that. Then I have installed and run the boot-repair utility. The utility instructs me to type several lines including sudo chroot "/mnt/boot-sav/sda6" apt-get purge -y grub*-common grub-common:i386 To which I receive the error E: Unable to locate package grub-common:i386 I am given to understand the issue may have to do with having UEFI vs BIOS (I believe I have UEFI), but do not understand this well. In any case I have subsequently run the boot-repair BootInfo Summary utility which created the following file h...
            Read more

            濃尾地震

            Image
            濃尾地震 『岐阜市街大地震之図』 歌川国利画 本震 発生日 1891年（明治24年）10月28日 発生時刻 6時38分50秒（JST） 震央 日本 岐阜県本巣郡西根尾村（現・本巣市） 北緯35度35分 東経136度20分（ 地図 ） 規模    マグニチュード（M）8.0 最大震度    震度7： 注1 福井県今立郡鯖江町、愛知県葉栗郡大田島村、東春日井郡勝川村 地震の種類 直下型地震 被害 死傷者数 死者7,273人、負傷者17,175人 注1：当時の震度階級では「激烈」 プロジェクト:地球科学 プロジェクト:災害 テンプレートを表示 濃尾地震 （のうびじしん）は、1891年（明治24年）10月28日に濃尾地方で発生した、日本史上最大の内陸地殻内地震。「 美濃・尾張地震 （みの・おわりじしん）」とも呼ばれている。辛卯の年に発生したことから 辛卯震災 と呼んでいる報告書もある。 目次 1 概要 1.1 震源断層 2 被害 3 各地の震度 4 前兆現象 5 報道 6 学術的な意義 7 地震防災 8 脚注 9 関連項目 10 外部リンク 概要 濃尾地震発生当時の根尾谷断層 濃尾地震を引き起こした根尾谷断層 写真中央を斜めに走る段差が根尾谷断層 濃尾地震は、1891年10月28日6時38分50秒に発生した。震源は、岐阜県本巣郡西根尾村（現・本巣市）、北緯35度35分、東経136度20分付近。河角廣 (1951) は岐阜市付近（北緯35.6度、東経136.6度）に震央を仮定し規模 M K = 7.0 を与え [1] 、マグニチュードは M = 8.4 に換算されているが、明治・大正期の地震については0.5程度大きく見積もられているとされる [2] 。また、震央距離と震度との関係など当時のデータから後にM8.0 [3] とも推定される。アメリカ地質調査所 (USGS) でも8.0としている [4] 。「根尾谷断層帯」が活動した典型的な内陸地殻内地震（いわゆる直下型地震）であり、これは記録が残っている日本の内陸...
            Read more