compartment - Online in the Cloud

PROGRAM:

NAME

compartment - secure program/service wrapper

SYNOPSIS

compartment [--cap CAPSET] [--chroot PATH] [--user USER] [--group GROUP] [--init PROGRAM]
[--verbose] [--quiet] [--fork] /full/path/to/program

DESCRIPTION

The Secure Compartment was designed to allow safe execution of priviliged and/or untrusted
executables and services. It has got all features possible included, which can be used to
minimize the risk of a trojanized or vulnerable program/service.

COMMANDLINE OPTIONS

--cap CAPSET
sets the defined CAPABILITY for the process. See the README file and the section
LIMITATIONS for more information and examples.

--chroot PATH
chroots to the PATH defined. It has to be a valid chroot environment. See the
README file for more information and examples.

--user USER
runs the program with uid/euid of USER

--group GROUP
runs the program with gid/egid of GROUP

--init PROGRAM
runs PROGRAM before running the untrusted program/service, e.g. to build a chroot
environment

--verbose
prints detailled information what compartment does.

--quit does not print syslog information about the use of compartment

--fork forks if everything was set up correctly, mother process will exit.

FEATURES

Linux Capabilities

supports all Linux capabilites
(see /usr/include/linux/capability.h and the README file)

Chrooting

supports a chroot setup

Privileges

supports running with defined user and/or group privileges

Setup Scripts

supports running of initial scripts
before running a program/service, e.g. to build a chroot environment.

LIMITATIONS

Currently the kernel does not allow capabilities on processes which are not running with
euid 0. Therefore compartment will exit with an error if --user and --cap is used
together.

Please note that this will change for the 2.4 kernel.

Use compartment online using onworks.net services