SYNOPSIS
compartment [--cap CAPSET] [--chroot PATH] [--user USER] [--group GROUP] [--init PROGRAM] [--verbose] [--quiet] [--fork] /full/path/to/program
DESCRIPTION
The Secure Compartment was designed to allow safe execution of priviliged and/or untrusted executables and services. It has got all features possible included, which can be used to minimize the risk of a trojanized or vulnerable program/service.
COMMANDLINE OPTIONS
- --cap CAPSET
-
sets the defined
CAPABILITY
for the process.
See the README file and the section LIMITATIONS for more information and examples.
- --chroot PATH
-
chroots
to the PATH defined. It has to be a valid chroot environment.
See the README file for more information and examples.
- --user USER
-
runs the program with uid/euid of USER
- --group GROUP
-
runs the program with gid/egid of GROUP
- --init PROGRAM
-
runs PROGRAM before running the untrusted program/service, e.g. to build a chroot environment
- --verbose
-
prints detailled information what
compartment
does.
- --quit
-
does not print syslog information about the use of
compartment
- --fork
-
forks if everything was set up correctly, mother process will exit.
FEATURES
Linux Capabilities
- supports all Linux capabilites
- (see /usr/include/linux/capability.h and the README file)
Chrooting
- supports a chroot setup
Privileges
- supports running with defined user and/or group privileges
Setup Scripts
- supports running of initial scripts
-
before running a program/service, e.g. to build a chroot environment.
LIMITATIONS
Currently the kernel does not allow capabilities on processes which are not running with euid 0. Therefore compartment will exit with an error if --user and --cap is used together.Please note that this will change for the 2.4 kernel.
BUGS
No bugs are currently known
DISTRIBUTION
compartment is part of the SuSE Linux Distribtution since 7.0 so it can be downloaded as an RPM file from the SuSE FTP servers. It can also be downloaded as a .tar.gz file from http://www.suse.de/~marcIt has been also part of the Debian GNU/Linux distribution since just after woody (Debian 3.0)
LICENCE
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.