jailkeeper | Monitor spawned child processes and make

jailkeeper is a JavaScript library. jailkeeper has no bugs, it has no vulnerabilities and it has low support. You can install using 'npm i jailkeeper' or download it from GitHub, npm.

JailKeeper was created for my needs on SpanDeX.io. SpanDeX and similar cloud services must run otherwise-unsecured shell scripts (in our case, LaTeX code which is turing-complete and can access the filesystem). Obviously this has huge security implications. Chroot jails make me a little uneasy and seem quite difficult to manage, and easy to break out of (though I’m open to decent, lightweight alternatives). SmartOS zones seem like a better choice but I don’t understand them yet ;). Thus, this is my first attempt at an alternative solution, which is to use truss or dtruss (Solaris/SmartOS or Mac OS X, respectively) to monitor all the input/output of a spawned child process. We can immediately see if a process attempts to open a file that it shouldn’t, kill the process, and notify the user (and server admins) that something funny is going on. Warning: I have only extensively tested this on Joyent’s SmartMachines, and I believe that there’s something wrong with dtruss on Mac OS 10.8 so I haven’t been able to test extensively on my local machine. Thus SmartOS/Solaris is supported well, but YMMV with other operating systems.