Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have to run a non-trusted, third-party application on a linux server.

The program should be run as a specified user for a limited time, for example 30s.

During this period, the program can use all the system resources, but it can write only below a specified directory.

After the program terminates or is terminated because of the timeout, the system have to be cleaned, so it is in exactly the same state as before running the application.

There should not be any descriptors, sockets, spawned processes, files or other system resources left out.

How can I do that?

share|improve this question

closed as off topic by mailq, Sven, Iain, Scott Pack, Shane Madden Oct 30 '11 at 20:28

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Stop hacking!!! –  mailq Oct 30 '11 at 20:07
    
This seems more like a design/programming question to me. –  Iain Oct 30 '11 at 20:09
    
It's not hacking, it's more like have the possibility to run a program every time in a "known, clean" environment, but without using virtualization. –  Hristo Hristov Oct 30 '11 at 20:13
    
It's not about programming, the program is not known. I have the system and the program, I have to start it and to have the system in the same state after that. –  Hristo Hristov Oct 30 '11 at 20:16

2 Answers 2

up vote 1 down vote accepted

Sounds like you're looking for something like an operating system container. The Solaris Version used to be called a Zone, which is a kind of virtualization where multiple virtual machines share a kernel, but in effect have separate PID 0 processes, and even different file-systems.

If you really do need to run something that needs to execute and then reset everything back to a steady state, something like this would be a good choice. That our a snap-shotted full Virtual Machine; start the machine, run the process, stop the machine, roll-back to the known-good snapshot. Some, such as VMWare, can even do this process live, though there is a quite noticeable pause as it commits a live memory snapshot to disk (or recovers it from disk).

share|improve this answer
    
The concept with the virtual machine is perfect, this is exactly what I need as effect. But the problem is that I want this to be fast, the loading of the snapshot would be too slow. I am looking for a way to do that faster. –  Hristo Hristov Oct 30 '11 at 20:20
    
The other problem with virtualization is that the system is already virtualized, it is running on a VPS. –  Hristo Hristov Oct 30 '11 at 20:26
    
@HristoHristov It is quite possible to nest virtualization. Use something like OpenVZ to create a new container and do the deeds on a LVM array (perhaps based on loopback files) that gets un-snapped when the process finishes running. –  sysadmin1138 Oct 30 '11 at 20:42
    
I will check this possibility, thanks! –  Hristo Hristov Oct 30 '11 at 20:46

Create a new shell as a wrapper around the user shell.

When the user logs in, this shell creates a dynamic named ramdisk, chroots into it, spawns the concrete user shell, creates a new thread that sleeps 30 seconds, and after waiting it kills all child processes recursively, then destroys the ramdisk and logs out the user.

Programming this is left out as a homework.

share|improve this answer
    
The application needs the system files (other applications, libraries, etc.) so chroot-ing would be a problem. How to make sure all resources are free after termination? How to kill all child processes? –  Hristo Hristov Oct 30 '11 at 20:34
    
bad question? too localized? downvote, closing? and you answer that? thanks anyway –  Hristo Hristov Oct 30 '11 at 20:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.