Restrict linux process write permission to one folder
2
votes
2
answers
2043
views
I want a process (and all its potential children) to be able to read the filesystem according to my user profile but I want to restrict that process's write permission to only a set of pre-selected folders (potentially only one).
chroot
seems to act too broadly. Restricting the process to a particular part of the filesystem which makes curbersome the need to mount /bin
folders and the like. My process should be able read the content of the filesystem as any normal process I launch.
I could use a docker container and mount a volume but that seems overkill: need to install docker, create an image, launch the container in it, etc...
Is there a way to do something like?:
restricted-exec --read-all --write-to /a/particular/path --write-to /another/particular/path my-executable -- --option-to-the-executable
Some sort of [unveil
](https://man.openbsd.org/unveil.2) but controlled by the calling process and only for write access.
Asked by Luke Skywalker
(205 rep)
Feb 27, 2022, 05:51 PM
Last activity: Nov 14, 2023, 02:39 PM
Last activity: Nov 14, 2023, 02:39 PM