Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 7. Securing Programs Using Sandbox

The sandbox security utility adds a set of SELinux policies that allow a system administrator to run an application within a tightly confined SELinux domain. Restrictions on permission to open new files or access to the network can be defined. This enables testing the processing characteristics of untrusted software securely, without risking damage to the system.

7.1. Running an Application Using Sandbox
Copiar o link

Before using the sandbox utility, the policycoreutils-sandbox package must be installed: 
~]# yum install policycoreutils-sandbox
Copy to Clipboard Toggle word wrap
The basic syntax to confine an application is: 
~]$ sandbox [options] application_under_test
Copy to Clipboard Toggle word wrap
To run a graphical application in a sandbox, use the -X option. For example: 
~]$ sandbox -X evince
Copy to Clipboard Toggle word wrap
The -X tells sandbox to set up a confined secondary X Server for the application (in this case, evince), before copying the needed resources and creating a closed virtual environment in the user’s home directory or in the /tmp directory.
To preserve data from one session to the next: 
~]$ sandbox -H sandbox/home -T sandbox/tmp -X firefox
Copy to Clipboard Toggle word wrap
Note that sandbox/home is used for /home and sandbox/tmp is used for /tmp. Different applications are placed in different restricted environments. The application runs in full-screen mode and this prevents access to other functions. As mentioned before, you cannot open or create files except those which are labeled as sandbox_x_file_t.
Access to the network is also initially impossible inside the sandbox. To allow access, use the sandbox_web_t label. For example, to launch Firefox: 
~]$ sandbox ‑X ‑t sandbox_web_t firefox
Copy to Clipboard Toggle word wrap

Warning

The sandbox_net_t label allows unrestricted, bi-directional network access to all network ports. The sandbox_web_t allows connections to ports required for web browsing only.
Use of sandbox_net_t should made with caution and only when required.
See the sandbox (8) manual page for information, and a full list of available options.
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2026 Red HatVoltar ao topo