Arch Linux

b4283

Member

Registered: 2008-11-26

Posts: 123

[SOLVED] safely run a downloaded binary

Hi,
i'm wondering that there are security risks when i'm running linux binaries downloaded from the internet.
suppose that there's a C program which is designed to destroy everything under my home directory (~/).

of course its not gonna destory my system because of permission problems, but, all other important stuff are gone as well.

so, is there a way to run a binary safely under linux (just like in VMs)?

Last edited by b4283 (2009-07-26 03:15:45)

b4283

Member

Registered: 2008-11-26

Posts: 123

Re: [SOLVED] safely run a downloaded binary

i have to apologize for the silly question that i just found out a stupid answer for myself.

all i have to do is use su to switch to another not so important user

Xyne

Administrator/PM

Registered: 2008-08-03

Posts: 6,963

Website

Re: [SOLVED] safely run a downloaded binary

so, is there a way to run a binary safely under linux (just like in VMs)?

Maybe I'm missing something obvious, but if you want to run it safely "just like in VMs", why don't you run it in a VM?

You could also run it as another user with restricted permissions to protect your own home directory. I think you can also use chroots to limit what it can do, but I don't know.

You're probably better of not running anything that you don't trust though. Even if you don't notice anything, it might be doing something nasty or be configured to wait until it does.

*edit*

i have to apologize for the silly question that i just found out a stupid answer for myself.

all i have to do is use su to switch to another not so important user

I really need to learn to refresh the page before replying.

Last edited by Xyne (2009-07-26 03:20:16)

---

My Arch Linux Stuff • Forum Etiquette • Community Ethos - Arch is not for everyone

b4283

Member

Registered: 2008-11-26

Posts: 123

Re: [SOLVED] safely run a downloaded binary

I really need to learn to refresh the page before replying.

lol. thanks for replying anyways, your gave other solutions as well, so it's pretty useful too.

ngoonee

Forum Fellow

From: Between Thailand and Singapore

Registered: 2009-03-17

Posts: 7,356

Re: [SOLVED] safely run a downloaded binary

chroot is the simplest way to do it, really.

---

Allan-Volunteer on the (topic being discussed) mailn lists. You never get the people who matters attention on the forums.
jasonwryan-Installing Arch is a measure of your literacy. Maintaining Arch is a measure of your diligence. Contributing to Arch is a measure of your competence.
Griemak-Bleeding edge, not bleeding flat. Edge denotes falls will occur from time to time. Bring your own parachute.

szymon_g

Member

Registered: 2008-11-24

Posts: 36

Re: [SOLVED] safely run a downloaded binary

you can always use AppArmor or TOMOYO - thanx that you will know which files binary has an access to.
and, as was written earlier, you can always use chroot- or standard, linux chroot or modified chroot provides by kernel patched by grsecurity.

b4283

Member

Registered: 2008-11-26

Posts: 123

Re: [SOLVED] safely run a downloaded binary

chroot is the simplest way to do it, really.

but don't you need to setup a whole root directory to make chroot work ?

Wintervenom

Member

Registered: 2008-08-20

Posts: 1,011

Re: [SOLVED] safely run a downloaded binary

chroot is the simplest way to do it, really.

but don't you need to setup a whole root directory to make chroot work ?

The pro is that is less work and overhead than setting up an entire operating system to do this in a virtual machine.  The con is that it still gets access to your devices and disks if the process gets root.

Last edited by Wintervenom (2009-07-28 01:58:18)

krolden

Member

Registered: 2009-06-30

Posts: 12

Re: [SOLVED] safely run a downloaded binary

alternatively you can try to analyse the binary.  Run strings against it, etc. before running the binary

IIRC there is a page on phrack on analysing binary files.

esh

Member

Registered: 2008-11-05

Posts: 28

Re: [SOLVED] safely run a downloaded binary

alternatively you can try to analyse the binary.  Run strings against it, etc. before running the binary

I know Linux users are meant to be geeks, but really....