7 replies to this topic

[Somelauw]

I want to make a program run but I want to limit it's reading, writing and execution rights to the stdin and stdout only.
The program should not be able to modify anything else than the stdin and stdout.
I think I could use chmod for this and maybe assign a userid to the program of a user with very few rights. The disadvantage would be that I need to create a dummy user.

Is there a way to restrict the file-acces with as few modifications to my system as possible?
My OS is an Ubuntu.
I would also like to be able to limit the memory the program is allowed to use when running.

[WingedPanther]

I'm a little confused about that. Do you mean you want to give it no rights to access files at all? Depending on what else you want it to do, that could be awkward. Ultimately, you can choose to only use stdin and stdout, but a pipe or redirect will get around that. Running it as a special user isn't really limiting the program, just the environment.

[Somelauw]

WingedPanther said:

Ultimately, you can choose to only use stdin and stdout, but a pipe or redirect will get around that.

Yes, I want to limit it's input/output to stdin/stdout.
I don't understand how the program is able to get around this using piping or redirect.

[WingedPanther]

When you call a program from the command line, you can specify the input/output to be results of other programs, files, etc. The result is that the OS will hook stdin/stdout to something other than the keyboard/monitor.

[Somelauw]

WingedPanther said:

When you call a program from the command line, you can specify the input/output to be results of other programs, files, etc. The result is that the OS will hook stdin/stdout to something other than the keyboard/monitor.

That's completely fine and it's even what I want.
Can you tell me how to restrict a program like this?

[WingedPanther]

Only use stdin and stdout for your output when you code it. It's more of a languages issue than an OS issue.

[Somelauw]

WingedPanther said:

Only use stdin and stdout for your output when you code it. It's more of a languages issue than an OS issue.

Yes, but I want to limit it externally since I am not writing the program itself.

[WingedPanther]

I don't think this will be possible. If you provide support to load the libraries for using stdin/stdout, then other libraries can be loaded as well, for things like GUI interfaces, etc.