restrict filesystem access from CGI

does anybody know how to restrict access from CGI scripts (python, perl, ruby and so on) to file-system files (/etc/passwd for instance) So I want to have something like PHP's open_basedir option for CGI

PS OS hasn'开发者_StackOverflowt any additional security things like grsecurity, apparmor or selinux

There are lots of ways to do this:

1. Use CGIwrap
2. If you insist on rolling it youself, use chroot.
3. Use file system permissions. Have you CGI script run as a specific user, like "restrict1234", and give restrict1234 access to only a specific directory.
4. Use capabilities, if your OS supports them. Lots do.