CODEWITHSUNDEEP
clinuxprocesspermissions
Jeroen
Jeroen

Reputation: 16825

Unique Process Permissions Linux

Is there a way to give a process on Linux based systems unique permissions in C? I basically want to restrict a process (launched by a host, like an event handler) from editing any files outside it's working directory, and creating sockets and such.

Would the only way to do it is to have a host process create a new user for each process it spawns and destroy the user afterwards?

Upvotes: 0

Views: 355

Answers (2)

Basile Starynkevitch
Basile Starynkevitch

Reputation: 1

You could use old setuid techniques to switch your process to the nobody uid and nogroup gid. Theses ids are designed to make a process unable to write any files (except inside all-writable directories).

Upvotes: 1

abligh
abligh

Reputation: 25129

The standard answer to this is chroot, which sets the process's root directory (and that of its children) to be the given directory.

However, if you want a better answer allowing you to isolate all aspects of the process and not just its file system, look at the unshare system call (wrapped in a modern glibc as a function). This is how containers are built.

Upvotes: 2

Related Questions