COMPARTMENT(1)

📦
version 1.3 · 2 versions
, in ubuntu resolute, ubuntu stonking

💖 COMPARTMENT(1) 💖

okay bestie, sit down, hydrate, because we're talking about compartment — it's a secure program/service wrapper, it lives in section 1 of the General Commands Manual, and honestly? it's giving bodyguard energy. 🫶

✨ NAME ✨

compartment — a secure program/service wrapper. that's it, that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

compartment [--cap CAPSET] [--chroot PATH] [--user USER] [--group GROUP]
       [--init PROGRAM] [--verbose] [--quiet] [--fork] /full/path/to/program

🦋 DESCRIPTION 🦋

The Secure Compartment was designed to allow safe execution of priviliged and/or untrusted executables and services. no cap. 🧚

It has got all features possible included, which can be used to minimize the risk of a trojanized or vulnerable program/service. like, it really said "i will hold your hand AND your permissions." 💅

👑 COMMANDLINE OPTIONS 👑

  • --cap CAPSET — sets the defined CAPABILITY for the process. See the README file for more information and examples. (yes, the README is where the lore lives, go read it 📖)
  • --chroot PATH — chroots to the PATH defined. It has to be a valid chroot environment. See the README file for more information and examples. no mid chroot setups allowed, it needs to be the real deal 💀
  • --user USER — runs the program with uid/euid of USER 🫶
  • --group GROUP — runs the program with gid/egid of GROUP 💜
  • --init PROGRAM — runs PROGRAM before running the untrusted program/service, e.g. to build a chroot environment. it's the lil pre-game ritual ✨
  • --verbose — prints detailled information what compartment does. it will literally narrate its whole life to you, main character energy 🎤
  • --quit — does not print syslog information about the use of compartment. quiet lil icon 🤫
  • --fork — forks if everything was set up correctly, mother process will exit. she raised you and then she left 🥲
ok so quick note, bestie: the SYNOPSIS up there says --quiet but the option list says --quit. i'm just reading the page, i'm not making the rules. 👀

🌈 FEATURES 🌈

🐧 Linux Capabilities

  • supports all Linux capabilites (see /usr/include/linux/capability.h and the README file)

🔒 Chrooting

  • supports a chroot setup

🎀 Privileges

  • supports running with defined user and/or group privileges

📜 Setup Scripts

  • supports running of initial scripts before running a program/service, e.g. to build a chroot environment.

💀 BUGS 💀

No bugs are currently known. flawless, untouchable, she ate and left no crumbs. 🍓

⭐ AUTHOR ⭐

Marc Heuse <marc@suse.de>

🌸 DISTRIBUTION 🌸

compartment is part of the SuSE Linux Distribtution since 7.0 so it can be downloaded as an RPM file from the SuSE FTP servers. It can also be downloaded as a .tar.gz file from http://www.suse.de/~marc 🌐

It has been also part of the Debian GNU/Linux distribution since just after woody (Debian 3.0). multi-fandom queen fr fr 👑

💅 LICENCE 💅

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

periodt. no warranty bestie, we said what we said. 😭

🔥 SEE ALSO 🔥

  • capset (2)
  • chroot (1)
  • chroot (2)

okay that's the whole page!! this came out of the General Commands Manual as COMPARTMENT(1), and that's the exact same name stamped at the bottom of the original too — so consider this your official sign-off: page COMPARTMENT(1), general commands manual, that's a wrap 🎀✨ love u, go compartment something responsibly 💖

📦 where this page comes from