grsecurity forums

I want to run untrusted code, pipe it input, redirect its output to a file, and verify that output all from a script. This has to happen automatically and preferable with as little down time between runs of untrusted code as possible. Is gresecurity the right tool for this task, or is something else better suited for what I want. The code I'm running should be very basic and not try to do anything 'deep'. If it is trying to do anything strange, its ok to assume the code isn't what I want and abort it without continuing, regardless of if it would be ultimately a trusted action.

Thanks.

cep221 wrote:I want to run untrusted code, pipe it input, redirect its output to a file, and verify that output all from a script. This has to happen automatically and preferable with as little down time between runs of

IMHO, yes, grsecurity seem good for it.

Use all protections like direct ports I/O (that option that disables xfree driver), probably PaX randomization is not needed here (since the code is "evil" already, and you want to isloate it).

Grsecurity improves chroot jail - to make it realy secure.
In addition use RBAC policy to strongly limit rights of the untrusted code.