# sandbox

## NAME



           sandbox - Run cmd under an SELinux sandbox
    


## SYNOPSIS



           **sandbox**[-C] [-s] [ -d DPI ] [-l level ] [[-M | -X]  -H homedir -T
           tempdir ] [ -R runuserdir ] [-I includefile ] [ -W windowmanager ]
           [ -w windowsize ] [[-i file ]...] [ -t type ] cmd
    
           **sandbox**[-C] [-s] [ -d DPI ] [-l level ] [[-M | -X]  -H homedir -T
           tempdir ] [ -R runuserdir ] [-I includefile ] [ -W windowmanager ]
           [ -w windowsize ] [[-i file ]...] [ -t type ] -S
    


## DESCRIPTION



           Run the _cmd_ application within a tightly confined SELinux domain.
           The default sandbox domain only allows applications the ability to
           read and write stdin, stdout and any other file descriptors handed
           to it. It is not allowed to open any other files.  The -M option
           will mount an alternate homedir and tmpdir to be used by the
           sandbox.
    
           If you have the _policycoreutils-sandbox_ package installed, you can
           use the -X option and the -M option.  **sandbox -X** allows you to run
           X applications within a sandbox.  These applications will start up
           their own X Server and create a temporary home directory and /tmp.
           The default SELinux policy does not allow any capabilities or
           network access.  It also prevents all access to the users other
           processes and files.  Files specified on the command that are in
           the home directory or /tmp will be copied into the sandbox
           directories.
    
           If directories are specified with -H or -T the directory will have
           its context modified with chcon(1) unless a level is specified
           with -l.  If the MLS/MCS security level is specified, the user is
           responsible to set the correct labels.
    
           **-h --help**
                  display usage message
    
           **-H --homedir**
                  Use alternate homedir to mount over your home directory.
                  Defaults to temporary. Requires -X or -M.
    
           **-i --include**
                  Copy this file into the appropriate temporary sandbox
                  directory. Command can be repeated.
    
           **-I --includefile**
                  Copy all files listed in inputfile into the appropriate
                  temporary sandbox directories.
    
           **-l --level**
                  Specify the MLS/MCS Security Level to run the sandbox with.
                  Defaults to random.
    
           **-M --mount**
                  Create a Sandbox with temporary files for $HOME and /tmp.
    
           **-s --shred**
                  Shred temporary files created in $HOME and /tmp, before
                  deleting.
    
           **-t --type**
                  Use alternate sandbox type, defaults to sandbox_t or
                  sandbox_x_t for -X.
    
                  **Examples:**
                  sandbox_t -    No X, No Network Access, No Open, read/write
                  on passed in file descriptors.
                  sandbox_min_t  -    No Network Access
                  sandbox_x_t    -    Ports for X applications to run locally
                  sandbox_web_t  -    Ports required for web browsing
                  sandbox_net_t  -         Network ports (for server
                  software)
                  sandbox_net_client_t     -    All network ports
    
           **-T --tmpdir**
                  Use alternate temporary directory to mount on /tmp.
                  Defaults to tmpfs. Requires -X or -M.
    
           **-R --runuserdir**
                  Use alternate temporary directory to mount on
                  XDG_RUNTIME_DIR (/run/user/$UID).
    
           **-S --session**
                  Run a full desktop session, Requires level, and home and
                  tmpdir.
    
           **-w --windowsize**
    
                  Specifies the windowsize when creating an X based Sandbox.
                  The default windowsize is 1000x700.
    
           **-W --windowmanager**
                  Select alternative window manager to run within **sandbox -X.**
                  Default to /usr/bin/openbox.
    
           **-X** Create an X based Sandbox for gui apps, temporary files for
                  $HOME and /tmp, secondary Xserver, defaults to sandbox_x_t
    
           **-d --dpi**
                  Set the DPI value for the sandbox X Server. Defaults to the
                  current X Sever DPI.
    
           **-C --capabilities**
                  Use capabilities within the sandbox. By default
                  applications executed within the sandbox will not be
                  allowed to use capabilities (setuid apps), with the -C
                  flag, you can use programs requiring capabilities.
    


## EXAMPLE



           Run a graphical application inside the sandbox
           # sandbox -X evince
           Run a graphical application that requires the use of network
           # sandbox ‑X ‑t sandbox_web_t firefox
           Preserve data from one session to the next
           # mkdir -p ~/sandbox/home ~/sandbox/tmp
           # sandbox -H ~/sandbox/home -T ~/sandbox/tmp -X libreoffice --writer
    


* * *