NAME

       compartment - secure program/service wrapper

SYNOPSIS

       compartment  [--cap  CAPSET]  [--chroot  PATH] [--user USER] [--group GROUP] [--init PROGRAM] [--verbose]
       [--quiet] [--fork] /full/path/to/program

DESCRIPTION

       The Secure Compartment was designed to allow safe execution of priviliged  and/or  untrusted  executables
       and  services.   It  has  got all features possible included, which can be used to minimize the risk of a
       trojanized or vulnerable program/service.

COMMANDLINE OPTIONS

       --cap CAPSET
              sets the defined CAPABILITY for the process.  See the README file and the section LIMITATIONS  for
              more information and examples.

       --chroot PATH
              chroots  to  the  PATH  defined. It has to be a valid chroot environment.  See the README file for
              more information and examples.

       --user USER
              runs the program with uid/euid of USER

       --group GROUP
              runs the program with gid/egid of GROUP

       --init PROGRAM
              runs PROGRAM before running the untrusted program/service, e.g. to build a chroot environment

       --verbose
              prints detailled information what compartment does.

       --quit does not print syslog information about the use of compartment

       --fork forks if everything was set up correctly, mother process will exit.

FEATURES

       Linux Capabilities

       supports all Linux capabilites
              (see /usr/include/linux/capability.h and the README file)

       Chrooting

       supports a chroot setup

       Privileges

       supports running with defined user and/or group privileges

       Setup Scripts

       supports running of initial scripts
              before running a program/service, e.g. to build a chroot environment.

LIMITATIONS

       Currently the kernel does not allow capabilities  on  processes  which  are  not  running  with  euid  0.
       Therefore compartment will exit with an error if --user and --cap is used together.

       Please note that this will change for the 2.4 kernel.

BUGS

       No bugs are currently known

AUTHOR

       Marc Heuse <marc@suse.de>

DISTRIBUTION

       compartment is part of the SuSE Linux Distribtution since 7.0 so it can be downloaded as an RPM file from
       the SuSE FTP servers. It can also be downloaded as a .tar.gz file from http://www.suse.de/~marc

       It has been also part of the Debian GNU/Linux distribution since just after woody (Debian 3.0)

LICENCE

       This  program  is  free  software;  you  can  redistribute it and/or modify it under the terms of the GNU
       General Public License as published by the Free Software Foundation; Version 2.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY  WARRANTY;  without  even
       the  implied  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
       License for more details.

SEE ALSO

       capset (2), chroot (1), chroot (2)

                                                                                                  COMPARTMENT(1)