Re: a utility for preventing exec() calls

[Nick C. <ni...@cl...>]

On Wed, 13 Feb 2019 at 09:00, Nick Cleaton <ni...@cl...> wrote:

>
> #!/bin/sh
> exec nsjail -Mo -R /usr -W /var/spool/frob libcallfilt denyexec
> /usr/bin/frob -- "$@"
>

Sorry, that should be:

#!/bin/sh
exec nsjail -Mo -R /usr -B /var/spool/frob -- libcallfilt denyexec
/usr/bin/frob -- "$@"

(nsjail takes -B not -W for a writable part of the filesystem, and I missed
out a --)