1.5 KiB
1.5 KiB
qssb.h (quite simple sandbox)
qssb.h is a simple header only library that provides an interface to sandbox applications on Linux. Using Seccomp and Linux Namespaces for that purpose requires some knowledge of annoying details which this library aims to abstract away as much as possible.
Status
No release yet, API is unstable.
Features
- Systemcall filtering
- restricting file system access
- dropping privileges
- isolating the application from the network, etc.
Requirements
Kernel >=3.17 sys/capabilities.h header. Depending on your system, libcap might be needed for this.
FAQ
Does the process need to be priviliged to utilize the library?
No.
It doesn't work on Debian!
You can thank a Debian-specific patch for that. In the future, the library may check against that. Execute echo 1 > /proc/sys/kernel/unprivileged_userns_clone to disable that patch for now.
Documentation
To be written
Examples
- qswiki: https://gitea.quitesimple.org/crtxcr/qswiki
- cgit sandboxed: https://gitea.quitesimple.org/crtxcr/cgitsb
- qpdfviewsb sandboxed (quick and dirty): https://gitea.quitesimple.org/crtxcr/qpdfviewsb
Contributing
Contributions are very welcome. Options:
- Pull-Request: github.com/quitesimpleorg/qssb
- Mail to qssb at quitesimple.org with instructions on where to pull the changes.
- Mailing a classic patch.
License
ISC