isolating process..
--------- Received message begins Here ---------
Quoted 12 lines · Erik Mouw
Quoted 4 lines
Quoted 3 lines
Is it possible by any means to isolate any given process, so that it'll be unable to crash system.
You just gave a nice description what an OS kernel should do :)
* Sigh * :-)
Quoted 4 lines
Quoted 4 lines
Please, supply ANY suggestions.
My ideas:
Quoted 8 lines
Quoted 3 lines
Quoted 2 lines
create some user, and decrease his ulimits up to miminum of 1 process, 0 core size, appropriate memory/ etc.
That's indeed the way to do it.
Byt how should I restrict him open socket and send some data (my IP, for example) somewhere ??
I thinks I'll end up writing kernel module which will restrict all ioctls but few {mmap, brk, geteuid, geuid, etc..} for given UID.
You might look into the Linux Security Module project. It's not finished but the hooks may give you what you need to start. See
http://mail.wirex.com/mailman/listinfo/linux-security-module
BTW, it is not possible to gurantee the process can't crash the system unless there are no other processes...
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: [email protected]
Any opinions expressed are solely my own.
Quoted 3 lines · Jesse Pollard
--------- Received message begins Here ---------
Quoted 2 lines
Byt how should I restrict him open socket and send some data (my IP, for example) somewhere ??
I believe that Netfilter will do this for you. Look at:
Owner match support (EXPERIMENTAL) CONFIG_IP_NF_MATCH_OWNER
Packet owner matching allows you to match locally-generated packets based on who created them: the user, group, process or session.
If you want to compile it as a module, say M here and read Documentation/modules.txt. If unsure, say `N'.
--
Russell King ([email protected]) The developer of ARM Linux
http://www.arm.linux.org.uk/personal/aboutme.html
Quoted 1 line · Russell King
I believe that Netfilter will do this for you.
a) that'll require 2.4.x
b) that'll require 2.4.x recompilation
c) that will definitely not solve all the problems arise
thanks, anyway