1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
.TH FSSHIELD 1 FSSHIELD
.SH NAME
fsshield \- Limit a new process's access to the filesystem
.SH SYNOPSIS
.B fsshield
.RB [ -a
.IR file ]\ ...\,
.BR [ -r
.IR file ]\ ...\,
.RB [ -t
.IR file ]\ ...\,
.RB [ -nR ]
.I utility
.RI [ argument ]\ ...
.SH DESCRIPTION
The
.B
fsshield utility runs a specified utility, but limits it's access to
the filesystem. By default it gives read-only access to some fundamental
directories and
.IR /etc/passwd ,
access to the current working directory, and
clean tmpfs mounts on
.I /tmp
and
.IR /var/tmp .
In this man page, \(dqread-only\(dq means that a bind-mount with the read-only
option is created. Other accessible files are normal bind-mounts. The
permissions on the files are not modified.
.SH OPTIONS
The following options are supported:
.TP
.BR -a \ \fIfile\fR
Make
.I file
accessible.
.TP
.BR -r \ \fIfile\fR
Make
.I file
accessible but read-only.
.TP
.BR -t \ \fIfile\fR
Mount a tmpfs on
.IR file .
.TP
.B -n
Do not apply the preset file accesses.
.TP
.B -R
Make the current working directory read-only.
.PP
The order of options do not matter, however
.B -a
overrides
.B -r
and
.BR -t ,
while
.B -r
overrides
.BR -t .
The preset files accesses are
.B -t
.I /tmp
.B -t
.I /var/tmp
.B -r
.I /var/empty
.B -r
.I /etc/passwd
.B -r
.I /usr
.B -r
.I /bin
.B -r
.I /sbin
.B -r
.I /lib
.B -r
.I /lib64
.B -r
.I /lib32
.B -r
.IR /libexec ,
however limited
to files that exist (including broken symlinks). Additionally
the current working directory is always accessible
.RB ( -a
.IR . ,
or if
.B -R
is used:
.B -r
.IR . ),
regardless of the use of
.BR -n .
.SH OPERANDS
The following operands are supported:
.TP
.I utility
The name of the utility to be invoked.
.TP
.I argument
A string to pass as an argument for the invoked utility.
.SH EXIT STATUS
If
.I utility
is invoked, the exit status of
.B fsshield
is the exit status of
.IR utility ;
otherwise, the
.B fsshield
utility exits with one of the following values:
.TP
125
An error occurred in the
.B fsshield
utility.
.TP
126
The utility specified by
.I utility
was found but could not be invoked.
.TP
127
The utility specified by
.I utility
could not be found.
.SH NOTES
The
.IR file s
can be any type of file, including directories,
not just regular files.
.SH SEE ALSO
None.
|
