3 ms·
I think most of the useful commands ought to be able to be run in a namespace where they can’t do much. Eg if they can’t see any files then they can’t delete th
by dan-robertson 8y ago
I think most of the useful commands ought to be able to be run in a namespace where they can’t do much. Eg if they can’t see any files then they can’t delete them. Unfortunately they wouldn’t then be able to read config files. Eg I would expect grep looks for a config file to decide what colour to highlight matches and so on.
Perhaps one could run them as a fresh user with few permissions, except it could still write to files if they are writable by “other”
- akavel 8y agoIs it possible to configure namespaces so that they allow read-only access?
- em-bee 8y agoi'd be ok with manually configuring up to tell it to copy certain config files to the sandbox so they are available for the commands to run there. there should not be to many commands that need configuring. greetings, eMBee.