NAME

       sandbox - Run cmd under an SELinux sandbox

SYNOPSIS

       sandbox  [-C]  [-s]  [  -d  DPI  ] [-l level ] [[-M | -X]  -H homedir -T tempdir ] [-I includefile ] [ -W
       windowmanager ] [ -w windowsize ] [[-i file ]...] [ -t type ] cmd

       sandbox [-C] [-s] [ -d DPI ] [-l level ] [[-M | -X]  -H homedir -T tempdir  ]  [-I  includefile  ]  [  -W
       windowmanager ] [ -w windowsize ] [[-i file ]...] [ -t type ] -S

DESCRIPTION

       Run the cmd application within a tightly confined SELinux domain.  The default sandbox domain only allows
       applications the ability to read and write stdin, stdout and any other file descriptors handed to it.  It
       is  not  allowed to open any other files.  The -M option will mount an alternate homedir and tmpdir to be
       used by the sandbox.

       If you have the policycoreutils-sandbox package installed, you can use the -X option and the  -M  option.
       sandbox -X allows you to run X applications within a sandbox.  These applications will start up their own
       X Server and create a temporary home directory and /tmp.  The default SELinux policy does not  allow  any
       capabilities  or  network  access.   It  also prevents all access to the users other processes and files.
       Files specified on the command that are in the home directory or /tmp will be  copied  into  the  sandbox
       directories.

       If  directories  are  specified  with -H or -T the directory will have its context modified with chcon(1)
       unless a level is specified with -l.  If the MLS/MCS security level is specified, the user is responsible
       to set the correct labels.

       -h --help
              display usage message

       -H --homedir
              Use  alternate  homedir  to mount over your home directory.  Defaults to temporary. Requires -X or
              -M.

       -i --include
              Copy this file into the appropriate temporary sandbox directory. Command can be repeated.

       -I --includefile
              Copy all files listed in inputfile into the appropriate temporary sandbox directories.

       -l --level
              Specify the MLS/MCS Security Level to run the sandbox with.  Defaults to random.

       -M --mount
              Create a Sandbox with temporary files for $HOME and /tmp.

       -s --shred
              Shred temporary files created in $HOME and /tmp, before deleting.

       -t --type
              Use alternate sandbox type, defaults to sandbox_t or sandbox_x_t for -X.

              Examples:
              sandbox_t -    No X, No Network Access, No Open, read/write on passed in file descriptors.
              sandbox_min_t  -    No Network Access
              sandbox_x_t    -    Ports for X applications to run locally
              sandbox_web_t  -    Ports required for web browsing
              sandbox_net_t  -         Network ports (for server software)
              sandbox_net_client_t     -    All network ports

       -T --tmpdir
              Use alternate temporary directory to mount on /tmp.  Defaults to tmpfs. Requires -X or -M.

       -S --session
              Run a full desktop session, Requires level, and home and tmpdir.

       -w --windowsize

              Specifies the windowsize when creating an X based Sandbox. The default windowsize is 1000x700.

       -W --windowmanager
              Select alternative window manager to run within sandbox -X.  Default to /usr/bin/x-window-manager.

       -X     Create an X based Sandbox for gui apps, temporary files for $HOME  and  /tmp,  secondary  Xserver,
              defaults to sandbox_x_t

       -d --dpi
              Set the DPI value for the sandbox X Server. Defaults to the current X Sever DPI.

       -C --capabilities Use capabilities within the
              sandbox.  By  default  applications  executed  within  the  sandbox  will  not  be  allowed to use
              capabilities (setuid apps), with the -C flag, you can use programs requiring capabilities.

SEE ALSO

       runcon(1), seunshare(8), selinux(8)

AUTHOR

       This manual page was written by Dan Walsh <dwalsh@redhat.com> and Thomas Liu <tliu@fedoraproject.org>