---
name: "compartment"
section: "1"
platform: "linux"
package: "compartment"
version: "1.1.0-5.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/compartment"
---

# compartment(1)

secure program/service wrapper

## NAME

compartment - secure program/service wrapper

## SYNOPSIS

**compartment \[--cap CAPSET\] \[--chroot PATH\] \[--user USER\] \[--group GROUP\] \[--init PROGRAM\] \[--verbose\] \[--quiet\] \[--fork\] /full/path/to/program**

## DESCRIPTION

The *Secure Compartment* was designed to allow safe execution of priviliged and/or untrusted executables and services. It has got all features possible included, which can be used to minimize the risk of a trojanized or vulnerable program/service.

## COMMANDLINE OPTIONS

- **--cap CAPSET**

  sets the defined *CAPABILITY* for the process. See the README file and the section LIMITATIONS for more information and examples.

- **--chroot PATH**

  *chroots* to the PATH defined. It has to be a valid chroot environment. See the README file for more information and examples.

- **--user USER**

  runs the program with uid/euid of USER

- **--group GROUP**

  runs the program with gid/egid of GROUP

- **--init PROGRAM**

  runs PROGRAM before running the untrusted program/service, e.g. to build a chroot environment

- **--verbose**

  prints detailled information what *compartment* does.

- **--quit**

  does not print syslog information about the use of *compartment*

- **--fork**

  forks if everything was set up correctly, mother process will exit.

## FEATURES

*Linux Capabilities*

- **supports all Linux capabilites**

  (see /usr/include/linux/capability.h and the README file)

*Chrooting*

- **supports a chroot setup**

  *Privileges*

- **supports running with defined user and/or group privileges**

  *Setup Scripts*

- **supports running of initial scripts**

  before running a program/service, e.g. to build a chroot environment.

## LIMITATIONS

Currently the kernel does not allow capabilities on processes which are not running with euid 0. Therefore *compartment* will exit with an error if --user and --cap is used together.

Please note that this will change for the 2.4 kernel.

## BUGS

No bugs are currently known

## AUTHOR

Marc Heuse *\<marc@suse.de\>*

## DISTRIBUTION

*compartment* is part of the SuSE Linux Distribtution since 7.0 so it can be downloaded as an RPM file from the SuSE FTP servers. It can also be downloaded as a .tar.gz file from *http://www.suse.de/~marc*

It has been also part of the Debian GNU/Linux distribution since just after woody (Debian 3.0)

## LICENCE

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

## SEE ALSO

*capset* (2), *chroot* (1), *chroot* (2)