[chmod]

This section can be used to change the apparent mode of files. This can include both increased and decreased privileges. The ability to increase privileges depends on the permissions of the running process. If the running process cannot read a file, it is not possible to elevate its privileges.

Each line should contain an octal integer followed by a path pattern (see below for path pattern syntax). The octal integer is in the format used by the chmod command. If the integer is preceeded with “+” or “-”, it will be interpretted as a relative mask instead of an absolute mode. Here are some examples:

644 <pattern>

Attempt to change the mode of all files which match the pattern to 0644. This will increase or decrease permissions as necessary.

-111 <pattern>

Remove executable permissions for all files which match the pattern. As this is a reduction in permissions, it will always succeed for all files. Other permissions are not affected.

+002 <pattern>

Attempt to make all files which match the pattern writable for “others”. Other permissions are not affected.

[dissociate]

This section contains a list of patterns, one per line. All files which match the pattern will appear to have been deleted in the mounted filesystem. This is useful for hiding files from the system.

Note that dissociating a directory also dissociates all of its contents.

Some paths should probably not be dissociated, such as /proc, /sys, /dev, etc. These contain information which may be necessary within the sandbox.

[live]

This section can be used to give the system direct access to the underlying files. All files matched by a pattern in this section can be directly modified through the mounted filesystem. This may be useful for /proc, /tmp, /var/log and others.

Extreme caution should be used when including this section in a configuration file. It you are not careful you may unintentionally negate all the benefits of the sandbox. Only use it if you know what you are doing and make sure that you test your patterns before using them for anything important.

Note that /dev/null, /dev/random and /dev/urandom are the only default “live” paths.

Regular Expressions

All patterns which begin with “regex:” will be treated as a regular expression. The regular expressions are interpretted using Python’s re module and thus the user should consult the module’s documentation to learn Python’s regex syntax.

Globbing

All patterns which begin with “glob:” are treated as globbing patterns. The patterns are interpretted using Python’s fnmatch module. As above, the user should consult the module’s documentation for details.

Literal

Patterns which begin with “/” are interpretted as absolute paths. Each such path will match a single file only.