1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
NAME
fsshield - Limit a new process's access to the filesystem
SYNOPSIS
fsshield [-a file] ... [-r file] ... [-t file] ... [-nR] utility [argument] ...
DESCRIPTION
The fsshield utility runs a specified utility, but limits it's access to
the filesystem. By default it gives read-only access to some fundamental
directories and /etc/passwd, access to the current working directory, and
clean tmpfs mounts on /tmp and /var/tmp.
In this man page, "read-only" means that a bind-mount with the read-only
option is created. Other accessible files are normal bind-mounts. The
permissions on the files are not modified.
OPTIONS
The following options are supported:
-a file
Make file accessible.
-r file
Make file accessible but read-only.
-t file
Mount a tmpfs on file.
-n
Do not apply the preset file accesses.
-R
Make the current working directory read-only.
The order of options do not matter, however -a overrides -r and -t,
while -r overrides -t. The preset files accesses are
-t /tmp -t /var/tmp -r /var/empty -r /etc/passwd -r /usr -r /bin
-r /sbin -r /lib -r /lib64 -r /lib32 -r /libexec, however limited
to files that exist (including broken symlinks). Additionally
the current working directory is always accessible (-a ., or
if -R is used: -r .), regardless of the use of -n.
OPERANDS
The following operands are supported:
utility
The name of the utility to be invoked.
argument
A string to pass as an argument for the invoked utility.
EXIT STATUS
If utility is invoked, the exit status of fsshield is the exit status
of utility; otherwise, the fsshield utility exits with one of the
following values:
125 An error occurred in the fsshield utility.
126 The utility specified by utility was found but could not be invoked.
127 The utility specified by utility could not be found.
NOTES
The files can be any type of file, including directories, not just
regular files.
SEE ALSO
None.
|
