What you are looking for is a tool that shows how a program interacts with the system (more specifically, with the kernel). Programs interact with the system using syscalls. Examples of syscalls are:
open
-- used to open a file;
read
and write
-- used to read/write from/to a file descriptor;
connect
-- used to connect a socket to a peer;
- many, many others (see
man syscalls
).
The point is: syscalls can be traced using ptrace(2)
. So, basically, you are looking for tools built around ptrace
. One of such tools is strace(1)
, which is a terminal application that takes a command as an argument and outputs:
- the system calls the program is calling;
- the arguments used to make the syscalls;
- the result of the syscalls.
The output is in a C-fashion. Here is an example:
$ strace cat test
execve("/bin/cat", ["cat", "test"], [/* 55 vars */]) = 0
/* ... */
open("test", O_RDONLY) = 3
/* ... */
read(3, "hello\n", 32768) = 6
write(1, "hello\n", 6) = 6
read(3, "", 32768) = 0
/* ... */
There you see that cat test
is opening a file named test
, reading its content (hello
) and placing it on the standard output.
strace
can produce much output, so be sure to read its man page (man strace
), especially the documentation of the -e
output that will let you see just the syscalls you are interested in.
Unfortunately, I'm not aware of graphical or easy-to-use alternatives. If you want to look for them, ptrace
should be one of your search keywords.
About the isolation, there are many technologies out there. Chroots, Linux containers (which are currently under development and incomplete), software virtualization and paravirtualization are the most used. However this is a topic way too large to discuss. I'd suggest opening a new question if you wish to have more details.
sandbox somebinary
and the imaginarysandbox
program would log all filessomebinary
read or written to, all IPs/ports connected to, data transferred etc. That would be a useful thing to have, I also would like to know if something like this exists (and, actually, without such tool observing a program running in a VM would be pointless as you can't say what it does there anyway). Good question.