compartment - secure program/service wrapper

       Marc Heuse <marc@suse.de>

       No bugs are currently known

--capCAPSET
              sets the defined CAPABILITY for the process.  See the README file and the section LIMITATIONS  for
              more information and examples.

       --chrootPATHchroots  to  the  PATH  defined. It has to be a valid chroot environment.  See the README file for
              more information and examples.

       --userUSER
              runs the program with uid/euid of USER

       --groupGROUP
              runs the program with gid/egid of GROUP

       --initPROGRAM
              runs PROGRAM before running the untrusted program/service, e.g. to build a chroot environment

       --verbose
              prints detailled information what compartment does.

       --quit does not print syslog information about the use of compartment--fork forks if everything was set up correctly, mother process will exit.

       The SecureCompartment was designed to allow safe execution of priviliged  and/or  untrusted  executables
       and  services.   It  has  got all features possible included, which can be used to minimize the risk of a
       trojanized or vulnerable program/service.

compartment is part of the SuSE Linux Distribtution since 7.0 so it can be downloaded as an RPM file from
       the SuSE FTP servers. It can also be downloaded as a .tar.gz file from http://www.suse.de/~marc

       It has been also part of the Debian GNU/Linux distribution since just after woody (Debian 3.0)

LinuxCapabilitiessupportsallLinuxcapabilites
              (see /usr/include/linux/capability.h and the README file)

       ChrootingsupportsachrootsetupPrivilegessupportsrunningwithdefineduserand/orgroupprivilegesSetupScriptssupportsrunningofinitialscripts
              before running a program/service, e.g. to build a chroot environment.

       This  program  is  free  software;  you  can  redistribute it and/or modify it under the terms of the GNU
       General Public License as published by the Free Software Foundation; Version 2.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY  WARRANTY;  without  even
       the  implied  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
       License for more details.

       Currently the kernel does not allow capabilities  on  processes  which  are  not  running  with  euid  0.
       Therefore compartment will exit with an error if --user and --cap is used together.

       Please note that this will change for the 2.4 kernel.

       compartment - secure program/service wrapper

capset (2), chroot (1), chroot (2)

                                                                                                  COMPARTMENT(1)

compartment[--capCAPSET][--chrootPATH][--userUSER][--groupGROUP][--initPROGRAM][--verbose][--quiet][--fork]/full/path/to/program