Take the 2-minute tour ×

I know that you can't technically chroot a thread, but I'm looking for functional alternatives that would limit the amount of permissions to an existing set of tasks within a thread.

Edit: This is for a Linux environment, however Windows related techniques would be useful as well (even if they have no *NIX equivalent.

share|improve this question
You would probably have to create different users with the permissions you want and run those tasks in the user context which applies to them. –  Garvin Dec 12 '12 at 22:52

1 Answer 1

up vote 2 down vote accepted

Setting permissions for a thread in windows is trivial using the impersonation functions in the Win32 API.

I'm not an expert in GNU/Linux system programming so there may be extensions that allow modification of the per thread UID, but as far as I know Unix systems have per process security not per thread as in Windows.

This is because historically Unix has used processes for parallel processing (fork) while Windows uses threads (CreateThread), and (historically?) creating new processes in Unix is comparable in speed to creating new threads in Windows.

I'm giving your question +1 since a cursory Google search seems to indicate the preferred way to restrict permissions is to fork the different tasks to processes by security and use setuid to set the permissions and optionally then chroot them.

I'd like to hear whether there are other options since, as mentioned above, this use case is rather trivial to implement in windows.

share|improve this answer
Thanks for the answer Eli Algranti. Linux multitasking was based totally on processes up until the last 5 years or so when pthreads began being introduced. Linux is thread friendly now, but it's user permission routines are very process based because as you stated Linux historically used child processes as apposed to threads. –  JSON Dec 13 '12 at 0:05
Thanks for the windows link. I didnt know how, but I knew they had to have some means of doing this on windows since its multithreading and has a fairly solid scheme for user control. Now the only question is whether *NIX has found a way to incorporate the same basic ideas in threads since they're pretty new to it. –  JSON Dec 13 '12 at 0:09

Your Answer


