I want to run small untrusted programs, but restrict them from accessing any files outside of their folder, network access, and everything else that they don't really need. What is the simplest way to achieve this?
-
1I have never used it, so I can't make a complete answer, but AFAIK, AppArmor (wiki.ubuntu.com/AppArmor) should be able to do this.– Javier RiveraCommented May 9, 2013 at 8:51
-
Check out Vagrant, a wrapper for VirtualBox. vagrantup.com and [on Wikipedia](en.wikipedia.org/wiki/Vagrant_(software%29) and on github– Janus TroelsenCommented May 9, 2013 at 11:41
-
@JavierRivera FWIW, SELinux as well. No idea how easy it'd be to get running on Ubuntu though.– TC1Commented May 9, 2013 at 13:07
-
Apparmor is already installed by default in Ubuntu, so it should be easier.– Javier RiveraCommented May 9, 2013 at 15:09
-
1It seems like they're are multiple possibilities: virtualisation using something like Virtualbox (like Vagrant), chroot, LXC, App Armor and SE Linux.– FlimmCommented May 15, 2013 at 13:21
|
Show 2 more comments
8 Answers
If they are really untrusted, and you want to be sure, you'd set up a separate box. Either really, or virtually.
Further, you don't want that box to be in the same network as your important stuff, if you are paranoid enough. In all solutions you'd set up a separate user with no rights, so not to open too much tools to the would-be compromiser.
- So the safest option would be a separate box removed physically from your network.
- You could give in a bit by adding it to the physical network, but on a different subnet: no 'real' connection inside
- A virtual machine would be an option, but might have to give up some performance
If you are bound on running it on the same box, you have for instance, this option
chroot. This is a default option for doing this for lots of people, and for non-specific threats it might even work. But it is NOT a security option, and can be broken out of rather easily. I'd suggest to use this as intended, i.e. not for security.
In the end you might need to set up a specific sandboxing model without the hassle of virtualization or separate boxes, or the still-at-risk situation of chroot. I doubt this is what you meant, but look at this link for some more in-depth information.
-
How safe would it be security wise to run an untrusted application on a virtual machine? I've heard of theoretical exploits which can access the host operating system through the hypervisor and infect it.– zuallauzCommented May 10, 2013 at 0:01
-
It could be, although I'm currently not aware of real threats like that, certainly not non-targeted ones. You should consider the attacker writing malware in a game would not go to those lengths. Now a spear-attack on you alone might ofcourse, if they know your layout, but still I don't think that's your first concern. If you are that certain they are mallicious you should really set up an isolated box anyway, network wise.– NanneCommented May 10, 2013 at 7:06
-
It would be nice if in linux existed some GUI for all that powerful security policies. Like docker, but for X11 apps, and has GUI. Commented Oct 16, 2020 at 17:20
Firejail is fairly new and in constant development. Easy to use.
You can simply:
sudo apt-get install firejail
firejail app
-
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Commented Dec 11, 2015 at 9:43
-
-
-
4I attempted use of firejail today only to find that it permits all file access by default and that its devs consider this to be a “design choice”, even though the rest of us would consider that a security issue. I’d exercise caution with this option.– HakanaiCommented Nov 18, 2021 at 2:15
-
firejail --private $mycmdwill mount a blank namespace onto the home directory. Also see its--help... there's a whole slew of--private-*options.– ulidtkoCommented Feb 25 at 12:23
Full virtualization/emulation (VirtualBox)
One possible solution is virtualization software such as VirtualBox which you can find in the software centre.
- Install Virtual box
- Create a virtual machine with networking enabled
- Install Ubuntu or perhaps a lighter desktop such as Lubuntu
- Fully update the installed OS (inside Virtual box)
- Disable Networking on the virtual machine
- Take a snapshot
You can now install the software you don't trust to see what it does. It can't upset the outside world or you host OS as it does not have access.
It may trash your virtual machine however but if it does you can just restore from your snapshot.
There may be other methods to limit the destructive power of untrusted software but this is the most robust method I can think of.
Container-based virtualization (Docker/LXC)
Another option may be LXC more information here
LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as “chroot on steroids”.
LXC builds up from chroot to implement complete virtual systems, adding resource management and isolation mechanisms to Linux’s existing process management infrastructure.
It's available in the software centre. I have no experience with however.
answered May 9, 2013 at 8:46
-
1That's just inconvenient. Create an entire virtual machine just to run games!!? that's not a very good solution. Don't you think setting the process's GID and UID would be WAY easier than this? Commented May 9, 2013 at 8:58
-
Actually I think setting up a virtual box is sufficiently easy that I probably would not bother with taking a snapshot. If it trashes my virtual machine, I can discard it.– emoryCommented May 9, 2013 at 14:18
-
Downvote: Factual incorrect reasoning even if the solution is rigth. Programs don't need to have the same privileges as the user running them. Linux and Ubuntu has supported MAC since years. Ubuntu uses AppArmos for this, and you can contain a program to a directory easily. Commented May 9, 2013 at 15:11
-
@JavierRivera "easily" is not the correct word, or a AppArmor profile and a SELinux policy for Firefox would be shipped by default with every distro and that is not the case. Ubuntu ships such profile but it is not active by default as it breaks a few "popular" Firefox features. There aren't much SELinux policies either for most GUI apps, such apps require too many permissions to be still called sandboxed. If you disagree, please post here links to sandbox Firefox safely using either AppArmor or SELinux! If you can I would be really happy :-)– HuygensCommented Oct 4, 2015 at 12:27
-
You should probably define "safe" for a meaningful answer but the default Firefox policy in Ubuntu is quite reasonable to me. Of course it breaks thing as is not as user-friendly as using nothing, but it's still much more user-friendly than a full virtual machine to me (that also breaks popular firefox features). Commented Oct 6, 2015 at 6:52
Docker will help you to set up containers that you can run off of your current kernel, yet keep contained away from the rest of your system. It seems pretty cutting edge but there's an Ubuntu focus an good documentation.
-
5I think this is a good option for most cases. However, the "untrusted" part of the original question, would concern me a bit. There are demonstrated hacks available that can allow an application to "break" out of it's container. And given that docker containers run at root access, this could be dangerous, if your goal was to sandbox the applications from each other. Commented Aug 22, 2014 at 22:37
-
@CrisHoldorph correct although Docker is getting better and I even think it is nowadays possible to run a docker unprivileged (not as root). This is certainly true now for LXC and LXD (the sometimes so called LXC daemon) can simplify greatly the creation of such containers. So modern unprivileged containers can be considered as an improvement in terms of security over chroot. But they are not an impenetrable barrier!– HuygensCommented Oct 4, 2015 at 12:21
-
mbox
Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems.
I've used it for a couple of things reliably.
subuser
You can use subuser to sandbox your applications with Docker. This allows you do things like sandbox GUI apps, which isn't easy to do with Docker directly.
sudo apt install subuser
I think, a possible solution is to create a separate user for testing purposes, and limit his privileges. This way you won't lose in performance, what would definitely happen in virtual machine, but I think this is less safe, if not set up very properly, which I can't advice on how to do.
-
2This doesn't protect the system from malicious software that may still get installed or run - it also is not sandboxing in the manner that this question means– Thomas Ward ♦Commented Dec 10, 2015 at 17:13
DoSH - Docker SHell
In case that you simply want to sandbox the activity of the users, you can use "DoSH"
DoSH (which stands for Docker SHell) is a development to create Docker containers when users log in the Linux system and run a shell into them, instead of symply creating the shell.
