Member Avatar for debasis29

Hi,

I am trying to run a process in my Linux system. For security reason, I want to create separate file systems for each individual process by which some system command should not corrupt the whole file system.

Is it possible? If yes, please help me with the solution.

Thanks,
-Debasis

  • 3 Contributors
  • 3 Replies
  • 217 Views
  • 23 Hours Discussion Span
  • Latest Post Latest Post by debasis29

Dani AI

Generated

pointed to sandboxing and suggested a chroot/loopback approach — both are reasonable starting points. For a stronger, practical per-process filesystem isolation, prefer kernel namespaces (mount + user namespaces) or a small-purpose sandbox tool that builds those namespaces for you. These approaches give each process its own view of the filesystem (a separate root or an overlay writable layer) without touching the host root.

Common, reliable options and trade-offs:

  • Use mount + user namespaces to give a process a different mount table and, if needed, an ephemeral writable layer (tmpfs or an overlay) over a read-only base. This isolates filesystem changes to that namespace. Caveats: kernel support and capabilities matter; some mounts/filesystems (overlayfs, pivot_root) can behave differently inside user namespaces or need CAP_SYS_ADMIN.
  • Use a focused tool instead of hand-rolling everything. bubblewrap (used by Flatpak) and firejail create unprivileged per-process sandboxes that handle namespace setup, mount layering and minimal device/proc handling for you. For heavier isolation and resource limits, systemd-nspawn, LXC or Docker provide container-style isolation plus cgroups.
  • FUSE-based per-user filesystems or tmpfs overlays can give writable, per-process areas without global mounts, but they won’t by themselves restrict what the process can execute.

Minimal conceptual workflow (illustrative):

# start a new user+mount namespace (requires kernel support)
unshare --user --map-root-user --mount --pid --fork /bin/bash

# create a writable overlay (tmpfs upper layer) and mount it over a chosen path
mkdir -p /tmp/upper /tmp/work /mnt/newroot
mount -t tmpfs tmpfs /tmp/upper
mount -t overlay overlay -o lowerdir=/,upperdir=/tmp/upper,workdir=/tmp/work /mnt/newroot

# arrange /proc /dev /sys as needed and exec the target process inside this namespace

If mounts fail with “operation not permitted”, check dmesg, kernel config and whether unprivileged user namespaces are enabled on your distro. Test with a purpose-built tool (bubblewrap/firejail) first — they handle many kernel quirks and are the fastest way to get safe, per-process filesystem isolation without reinventing the wheel.

Recommended Answers

All 3 Replies

Member Avatar for L7Sqr

You may want to look into the concept of sandboxing instead of seperate file systems.

Member Avatar for rubberman

There are a number of methods to do this. One is to create a chroot environment for each process. You can restrict precisely what applications can be run there, and associated them with specific system directories. This is somthing like what L7Sqr mentions about "sandboxing" the applications, instead of separate file systems. That said, you can create a virtual file system that is actually a file that is mounted with the loop specification. IE, you can create an empty file, initialize it with a file system internally, and then use the "mount [-t fstype] loopfilename" command.

Member Avatar for debasis29

Thank you very much. I will check the chroot environment option and let you people know.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.