* the easy way to sandbox?
@ 2012-05-21 16:28 ivo welch
2012-05-21 16:45 ` Mihai Donțu
2012-05-21 18:52 ` Alan Cox
0 siblings, 2 replies; 3+ messages in thread
From: ivo welch @ 2012-05-21 16:28 UTC (permalink / raw)
To: linux-kernel
Suggestion: introduce a system call that eliminates access to all
real file systems for the current process. the only permissible
interaction would be stdin, stdout, and stderr.
this would make it very simple to write a sandboxed safe fcgi script.
the script could load all the dynamic libraries and data it wants, and
then call this no-more-filesystem-access feature (preferably allowable
without root privileges). thereafter, even if a hacker takes control
of the script, not much permanent damage can happen.
right now, it is much more complex to accomplish this---which is why
sandboxing cgi scripts is not used too often.
sincerely,
/iaw
----
Ivo Welch (ivo.welch@gmail.com)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: the easy way to sandbox?
2012-05-21 16:28 the easy way to sandbox? ivo welch
@ 2012-05-21 16:45 ` Mihai Donțu
2012-05-21 18:52 ` Alan Cox
1 sibling, 0 replies; 3+ messages in thread
From: Mihai Donțu @ 2012-05-21 16:45 UTC (permalink / raw)
To: ivo.welch; +Cc: ivo.welch, linux-kernel
On Mon, 21 May 2012 09:28:13 -0700 ivo welch wrote:
> Suggestion: introduce a system call that eliminates access to all
> real file systems for the current process. the only permissible
> interaction would be stdin, stdout, and stderr.
>
> this would make it very simple to write a sandboxed safe fcgi script.
> the script could load all the dynamic libraries and data it wants, and
> then call this no-more-filesystem-access feature (preferably allowable
> without root privileges). thereafter, even if a hacker takes control
> of the script, not much permanent damage can happen.
>
> right now, it is much more complex to accomplish this---which is why
> sandboxing cgi scripts is not used too often.
>
Check this out: http://en.wikipedia.org/wiki/Seccomp
--
Mihai Donțu
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: the easy way to sandbox?
2012-05-21 16:28 the easy way to sandbox? ivo welch
2012-05-21 16:45 ` Mihai Donțu
@ 2012-05-21 18:52 ` Alan Cox
1 sibling, 0 replies; 3+ messages in thread
From: Alan Cox @ 2012-05-21 18:52 UTC (permalink / raw)
To: ivo.welch; +Cc: ivo.welch, linux-kernel
On Mon, 21 May 2012 09:28:13 -0700
ivo welch <ivo.welch@anderson.ucla.edu> wrote:
> Suggestion: introduce a system call that eliminates access to all
> real file systems for the current process. the only permissible
> interaction would be stdin, stdout, and stderr.
>
> this would make it very simple to write a sandboxed safe fcgi script.
No it wouldn't - because of things like ptrace.
Sandboxing done right is *hard*. SELinux and the other security setups
can do it. Containers can do interesting stuff in this space. Probably
the distros sometimes need to package the tools for it better.
Take a look at some of the cloud service code people have published.
Alan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-05-21 18:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-05-21 16:28 the easy way to sandbox? ivo welch
2012-05-21 16:45 ` Mihai Donțu
2012-05-21 18:52 ` Alan Cox
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox