SBOX: Put CGI Scripts in a Box

sbox is a CGI wrapper script that allows Web sites to safely grant CGI authoring privileges to untrusted or naive authors. The script increases security in several ways. It changes the process privileges of CGI scripts to match their owners, preventing one script from interfering with another's data les or operations. It establishes con gurable ceilings on script resource usage, avoiding intentional or unintentional denial of service attacks. Most importantly, sbox can also be used to run untrusted CGI scripts within a chroot()-ed directory, thereby preventing CGI scripts from accessing sensitive portions of the le system. sbox can be used and redistributed freely. The complete package is available for download at http:// stein.cshl.org/WWW/software/ sbox/