Sample Header Ad - 728x90

Restrict linux process write permission to one folder

2 votes
2 answers
2043 views
I want a process (and all its potential children) to be able to read the filesystem according to my user profile but I want to restrict that process's write permission to only a set of pre-selected folders (potentially only one). chroot seems to act too broadly. Restricting the process to a particular part of the filesystem which makes curbersome the need to mount /bin folders and the like. My process should be able read the content of the filesystem as any normal process I launch. I could use a docker container and mount a volume but that seems overkill: need to install docker, create an image, launch the container in it, etc... Is there a way to do something like?:
restricted-exec --read-all --write-to /a/particular/path --write-to /another/particular/path my-executable -- --option-to-the-executable
Some sort of [unveil](https://man.openbsd.org/unveil.2) but controlled by the calling process and only for write access.
Asked by Luke Skywalker (205 rep)
Feb 27, 2022, 05:51 PM
Last activity: Nov 14, 2023, 02:39 PM