Jul's page (Hungarian) : Jul's packages : imprison
imprison [--root|-r new rootdir] [--caps|-c capability set] [--user|-u username] [--set-groups|-G] [--] command [arg [arg...]]
# imprison -u bin /usr/bin/id uid=1(bin) gid=1(bin) groups=1(bin) # imprison -u bin -G /usr/bin/id uid=1(bin) gid=1(bin) groups=1(bin),2(daemon),3(sys)
This assumes that execve(2) to nc keeps CAP_NET_BIND_SERVICE. This can be done with mandatory access control, or my patch (see kernel patches page).
# mkdir -p jail/{bin,etc,lib} # cp /etc/{group,resolv.conf,ld.so.conf} jail/etc # cp /lib/{ld,libc}-*.so jail/lib # cp /usr/bin/id /usr/bin/nc jail/bin # ldconfig -r jail # imprison -u bin -G -r jail -c "cap_net_bind_service=ep" -- /bin/nc -l -p 50 -e /bin/id 127.1while from another terminal:
# telnet 0 50 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. uid=1 gid=1 groups=1,2,3 Connection closed by foreign host.