-1

I have to run a non-trusted, third-party application on a linux server.

The program should be run as a specified user for a limited time, for example 30s.

During this period, the program can use all the system resources, but it can write only below a specified directory.

After the program terminates or is terminated because of the timeout, the system have to be cleaned, so it is in exactly the same state as before running the application.

There should not be any descriptors, sockets, spawned processes, files or other system resources left out.

How can I do that?

Improve this question
4
  • 1
    Stop hacking!!!
    – mailq
    Oct 30, 2011 at 20:07
  • This seems more like a design/programming question to me.
    – user9517
    Oct 30, 2011 at 20:09
  • It's not hacking, it's more like have the possibility to run a program every time in a "known, clean" environment, but without using virtualization.
    – Hristo Hristov
    Oct 30, 2011 at 20:13
  • It's not about programming, the program is not known. I have the system and the program, I have to start it and to have the system in the same state after that.
    – Hristo Hristov
    Oct 30, 2011 at 20:16

2 Answers 2

Reset to default
1

Sounds like you're looking for something like an operating system container. The Solaris Version used to be called a Zone, which is a kind of virtualization where multiple virtual machines share a kernel, but in effect have separate PID 0 processes, and even different file-systems.

If you really do need to run something that needs to execute and then reset everything back to a steady state, something like this would be a good choice. That our a snap-shotted full Virtual Machine; start the machine, run the process, stop the machine, roll-back to the known-good snapshot. Some, such as VMWare, can even do this process live, though there is a quite noticeable pause as it commits a live memory snapshot to disk (or recovers it from disk).

Improve this answer
3
  • The concept with the virtual machine is perfect, this is exactly what I need as effect. But the problem is that I want this to be fast, the loading of the snapshot would be too slow. I am looking for a way to do that faster.
    – Hristo Hristov
    Oct 30, 2011 at 20:20
  • The other problem with virtualization is that the system is already virtualized, it is running on a VPS.
    – Hristo Hristov
    Oct 30, 2011 at 20:26
  • @HristoHristov It is quite possible to nest virtualization. Use something like OpenVZ to create a new container and do the deeds on a LVM array (perhaps based on loopback files) that gets un-snapped when the process finishes running.
    – sysadmin1138 ♦
    Oct 30, 2011 at 20:42
0

Create a new shell as a wrapper around the user shell.

When the user logs in, this shell creates a dynamic named ramdisk, chroots into it, spawns the concrete user shell, creates a new thread that sleeps 30 seconds, and after waiting it kills all child processes recursively, then destroys the ramdisk and logs out the user.

Programming this is left out as a homework.

Improve this answer
2
  • The application needs the system files (other applications, libraries, etc.) so chroot-ing would be a problem. How to make sure all resources are free after termination? How to kill all child processes?
    – Hristo Hristov
    Oct 30, 2011 at 20:34
  • bad question? too localized? downvote, closing? and you answer that? thanks anyway
    – Hristo Hristov
    Oct 30, 2011 at 20:47

Not the answer you're looking for? Browse other questions tagged .