Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to run small untrusted programs, but restrict them from accessing any files outside of their folder, network access, and everything else that they don't really need. What is the simplest way to achieve this?

share|improve this question
    
I have never used it, so I can't make a complete answer, but AFAIK, AppArmor (wiki.ubuntu.com/AppArmor) should be able to do this. –  Javier Rivera May 9 '13 at 8:51
    
Check out Vagrant, a wrapper for VirtualBox. vagrantup.com and on Wikipedia and on github –  Janus Troelsen May 9 '13 at 11:41
    
@JavierRivera FWIW, SELinux as well. No idea how easy it'd be to get running on Ubuntu though. –  TC1 May 9 '13 at 13:07
    
Apparmor is already installed by default in Ubuntu, so it should be easier. –  Javier Rivera May 9 '13 at 15:09
1  
It seems like they're are multiple possibilities: virtualisation using something like Virtualbox (like Vagrant), chroot, LXC, App Armor and SE Linux. –  Flimm May 15 '13 at 13:21

5 Answers 5

If they are really untrusted, and you want to be sure, you'd set up a separate box. Either really, or virtually.

Further, you don't want that box to be in the same network as your important stuff, if you are paranoid enough. In all solutions you'd set up a separate user with no rights, so not to open too much tools to the would-be compromiser.

  • So the safest option would be a separate box removed physically from your network.
  • You could give in a bit by adding it to the physical network, but on a different subnet: no 'real' connection inside
  • A virtual machine would be an option, but might have to give up some performance

If you are bound on running it on the same box, you have for instance, this option

  • chroot. This is a default option for doing this for lots of people, and for non-specific threats it might even work. But it is NOT a security option, and can be broken out of rather easily. I'd suggest to use this as intended, i.e. not for security.

In the end you might need to set up a specific sandboxing model without the hassle of virtualisation or separate boxes, or the still-at-risk situation of chroot. I doubt this is what you meant, but look at this link for some more in-depth information: http://stackoverflow.com/questions/4249063/how-can-i-run-an-untrusted-c-program-in-a-sandbox-in-linux

share|improve this answer
    
How safe would it be security wise to run an untrusted application on a virtual machine? I've heard of theoretical exploits which can access the host operating system through the hypervisor and infect it. –  zuallauz May 10 '13 at 0:01
    
It could be, although I'm currently not aware of real threats like that, certainly not non-targeted ones. You should consider the attacker writing malware in a game would not go to those lengths. Now a spear-attack on you alone might ofcourse, if they know your layout, but still I don't think that's your first concern. If you are that certain they are mallicious you should really set up an isolated box anyway, network wise. –  Nanne May 10 '13 at 7:06

One possible solution is virtualization software such as Virtual box which you can find in the software centre.

  • Install Virtual box
  • Create a virtual machine with networking enabled
  • Install Ubuntu or perhaps a lighter desktop such as Lubuntu
  • Fully update the installed OS (inside Virtual box)
  • Disable Networking on the virtual machine
  • Take a snapshot

You can now install the software you don't trust to see what it does. It can't upset the outside world or you host OS as it does not have access.

It may trash your virtual machine however but if it does you can just restore from your snapshot.

There may be other methods to limit the destructive power of untrusted software but this is the most robust method I can think of.

Another option may be LXC more information here

LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as “chroot on steroids”.

LXC builds up from chroot to implement complete virtual systems, adding resource management and isolation mechanisms to Linux’s existing process management infrastructure.

It's available in the software centre. I have no experience with however.

share|improve this answer
    
That's just inconvenient. Create an entire virtual machine just to run games!!? that's not a very good solution. Don't you think setting the process's GID and UID would be WAY easier than this? –  Jack Mayerz May 9 '13 at 8:58
    
Actually I think setting up a virtual box is sufficiently easy that I probably would not bother with taking a snapshot. If it trashes my virtual machine, I can discard it. –  emory May 9 '13 at 14:18
    
Downvote: Factual incorrect reasoning even if the solution is rigth. Programs don't need to have the same privileges as the user running them. Linux and Ubuntu has supported MAC since years. Ubuntu uses AppArmos for this, and you can contain a program to a directory easily. –  Javier Rivera May 9 '13 at 15:11

Docker will help you to set up containers that you can run off of your current kernel, yet keep contained away from the rest of your system. It seems pretty cutting edge but there's an Ubuntu focus an good documentation.

http://www.docker.io/

share|improve this answer

I think, a possible solution is to create a separate user for testing purposes, and limit his privileges. This way you won't lose in performance, what would definitely happen in virtual machine, but I think this is less safe, if not set up very properly, which I can't advice on how to do.

share|improve this answer

mbox

"Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems." http://pdos.csail.mit.edu/mbox/

-- https://github.com/tsgates/mbox

I've used it for a couple of things reliably.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.