There are multiple possibilities with Linux to sandbox applications.<\/p>\n
Example<\/strong> (with changed system root)<\/p>\n There are multiple possibilities with Linux to sandbox applications. chroot … Changed file system root namespaces … Separated namespaces (e.g.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false},"categories":[65],"tags":[],"_links":{"self":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/8611"}],"collection":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8611"}],"version-history":[{"count":10,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/8611\/revisions"}],"predecessor-version":[{"id":16424,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/8611\/revisions\/16424"}],"wp:attachment":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8611"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\r\n#include <filesystem>\r\n#include <iostream>\r\n#include <vector>\r\n\r\n#include <errno.h>\r\n#include <fcntl.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n\r\n#include <sys\/mount.h>\r\n#include <sys\/types.h>\r\n#include <sys\/wait.h>\r\n\r\nnamespace sfs = std::filesystem;\r\n\r\nvoid mountDeps(std::string& chrootPath, std::vector<std::string>& deps);\r\nvoid unmountDeps(std::string& chrootPath, std::vector<std::string>& deps);\r\nvoid startApp(std::string& chrootPath, std::vector<std::string>& deps);\r\nvoid changeRoot(std::string& chrootPath);\r\n\r\nint main()\r\n{\r\n std::vector<std::string> deps = { "child.out", "\/lib", "\/lib64" };\r\n std::string chrootPath = "\/tmp\/chroot\/";\r\n\r\n sfs::create_directory(chrootPath);\r\n mountDeps(chrootPath, deps);\r\n\r\n startApp(chrootPath, deps);\r\n\r\n unmountDeps(chrootPath, deps);\r\n sfs::remove_all(chrootPath);\r\n\r\n return 0;\r\n}\r\n\r\nvoid mountDeps(std::string& chrootPath, std::vector<std::string>& deps)\r\n{\r\n for (std::string& dep : deps)\r\n {\r\n std::string dest = chrootPath + dep;\r\n\r\n if (sfs::is_directory(dep)) { sfs::create_directory(dest); }\r\n else { close(open(dest.c_str(), O_WRONLY | O_CREAT, 0755)); }\r\n\r\n if (mount(dep.c_str(), dest.c_str(), "", MS_BIND, ""))\r\n {\r\n std::cerr << "Bind mounting from " << dep << " to " << dest <<\r\n " failed: " << strerror(errno) << std::endl;\r\n }\r\n }\r\n}\r\n\r\nvoid unmountDeps(std::string& chrootPath, std::vector<std::string>& deps)\r\n{\r\n for (std::string& dep : deps)\r\n {\r\n std::string dest = chrootPath + dep;\r\n\r\n if (umount2(dest.c_str(), MNT_DETACH))\r\n {\r\n std::cerr << "Unmounting of " << dest <<\r\n " failed: " << strerror(errno) << std::endl;\r\n }\r\n\r\n sfs::remove_all(dest);\r\n }\r\n}\r\n\r\nvoid startApp(std::string& chrootPath, std::vector<std::string>& deps)\r\n{\r\n pid_t pid = fork();\r\n\r\n switch (pid)\r\n {\r\n case -1:\r\n \/* Couldn't fork *\/\r\n {\r\n std::cerr << "Couldn't fork" << std::endl;\r\n }\r\n break;\r\n case 0:\r\n \/* Child process *\/\r\n {\r\n changeRoot(chrootPath);\r\n\r\n std::string execFile = ".\/" + deps[0];\r\n if (execlp(execFile.c_str(), execFile.c_str(), NULL) == -1)\r\n {\r\n std::cerr << "Execution of " << deps[0] << " failed: "\r\n << strerror(errno) << std::endl;\r\n }\r\n \/\/ The child is gone now\r\n }\r\n break;\r\n default:\r\n \/* Parent process *\/\r\n {\r\n std::cout << "Parent: I put my child in a sandbox" << std::endl;\r\n waitpid(pid, NULL, 0);\r\n }\r\n break;\r\n }\r\n}\r\n\r\nvoid changeRoot(std::string& chrootPath)\r\n{\r\n if (chroot(chrootPath.c_str()) == -1)\r\n {\r\n std::cerr << "Chroot to " << chrootPath << " failed: "\r\n << strerror(errno) << std::endl;\r\n }\r\n\r\n if (chdir("\/") == -1)\r\n {\r\n std::cerr << "Chdir to root failed: "\r\n << strerror(errno) << std::endl;\r\n }\r\n}\r\n<\/pre>\n\r\n#include <filesystem>\r\n#include <fstream>\r\n#include <iostream>\r\n\r\nnamespace sfs = std::filesystem;\r\n\r\nint main()\r\n{\r\n std::cout << "Child: Let's check the root:";\r\n for (auto& entry : sfs::directory_iterator("\/"))\r\n {\r\n std::cout << " " << entry.path();\r\n }\r\n std::cout << std::endl;\r\n\r\n std::cout << "Child: Oh shit, I have to play in a sandbox" << std::endl;\r\n\r\n return 0;\r\n}\r\n<\/pre>\n\r\n$ g++ child.cpp -o child.out\r\n\r\n$ ldd child.out\r\nlinux-vdso.so.1 (0x00007ffcc8375000)\r\nlibstdc++.so.6 => \/lib\/x86_64-linux-gnu\/libstdc++.so.6 (0x00007f50bb800000)\r\nlibc.so.6 => \/lib\/x86_64-linux-gnu\/libc.so.6 (0x00007f50bb400000)\r\nlibm.so.6 => \/lib\/x86_64-linux-gnu\/libm.so.6 (0x00007f50bb715000)\r\n\/lib64\/ld-linux-x86-64.so.2 (0x00007f50bbb1e000)\r\nlibgcc_s.so.1 => \/lib\/x86_64-linux-gnu\/libgcc_s.so.1 (0x00007f50bbae3000)\r\n\r\n$ g++ main.cpp -o main.out\r\n\r\n$ sudo .\/main.out\r\nParent: I put my child in a sandbox\r\nChild: Let's check the root: \"\/child.out\" \"\/lib\" \"\/lib64\"\r\nChild: Oh shit, I have to play in a sandbox\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"