Noid

Noid is a system for controlling the environment of individual processes in a Unix system. It lets any user run programs while:

• Giving it an individual, per-process file system namespace
• Disabling set-uid and set-gid bits on any executable it runs
• Closing all unwanted open file descriptors
• Only passing through specified environment variables

These Noid modules are currently in beta stage, and works only on Linux 2.4. There are no known bugs on uni-processor i386 (and user-mode) systems, but SMP and other architectures are untested.

Future extensions will include:

• Controlling network access
• Restricting system calls like ptrace