<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">2015-08-27 12:18 GMT+02:00 John Crispin <span dir="ltr"><<a href="mailto:blogic@openwrt.org" target="_blank">blogic@openwrt.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class=""><br>
<br>
On 26/08/2015 18:20, Etienne Champetier wrote:<br>
><br>
><br>
> 2015-08-26 15:48 GMT+02:00 John Crispin <<a href="mailto:blogic@openwrt.org">blogic@openwrt.org</a><br>
</span>> <mailto:<a href="mailto:blogic@openwrt.org">blogic@openwrt.org</a>>>:<br>
<span class="">><br>
> On 26/08/2015 01:00, Etienne CHAMPETIER wrote:<br>
> > This patch series rework a bit ujail,<br>
> > and add capabilities support to it<br>
><br>
> nice<br>
><br>
> ><br>
> > Seccomp filter are very powerful but not totally generic,<br>
> > each arch can have different set of syscalls,<br>
> > each libc can use different syscall for the same function,<br>
> > and seccomp isn't supported on all arch.<br>
> ><br>
> > Capabilities are more high level, but still can restrict<br>
> > jail to a sane minimum of privileges.<br>
><br>
> ><br>
> > Patch 4 is a bit big and i can split it if needed, just tell me how<br>
><br>
> will have a closer look next few days<br>
><br>
> forgot to say it's tested on ar71xx with CC (and also on ubuntu 14.04)<br>
><br>
> there seem to be a way to escape from the rebind mount jail that QCA has<br>
> found<br>
><br>
> more than one ;) can you share? (with root rights you can kexec, mount<br>
> /dev, ...)<br>
<br>
</span>well if you are root you are root and can delete the bootloader. the<br>
idea of the jail is that you are not root.<br></blockquote><div> </div><div>Totaly disagree on that.<br></div><div>Many core program need 1 or a few capabilities, but don't start if you are not root<br></div><div>take for exemple busybox ntpd,<br><a href="http://git.busybox.net/busybox/tree/networking/ntpd.c#n2122">http://git.busybox.net/busybox/tree/networking/ntpd.c#n2122</a> <br></div><div>i'm pretty sure it only need CAP_SYS_TIME, but it check for root rights :)<br></div><div><br></div><div>root give you 2 things:<br></div><div>all the capabilities,<br></div><div>read write access on root file<br></div><div>there is no uid==0 in the kernel, only capabilities check<br></div><div><br></div><div>If you drop all capabilities, root is a normal user,<br>with the exception that he is in general the owner of most or all the file<br></div><div>(that's when namespaces come into play)<br></div><div><br></div><div>For me the idea of the jail is to restrict the daemon as much as possible,<br>without patching it, so if it need to be root ...<br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
i will prvide details later on<br></blockquote><div>cool<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
> that's why you really need to limit rights with capabilities drop or<br>
> seccomp filter<br>
> (i'm adding a vague warning in usage)<br>
<br>
</span>why do you want to run a privileged user and restrict is perms rather<br>
than just use an unprivileged user ?<br></blockquote><div>see comment before<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
><br>
><br>
> and i have not had the time yet to finish my jailfs module.<br>
><br>
> with my patches you don't see all the bind mount anymore ("in the host"),<br>
> they are only in the jail mount namespace.<br>
><br>
> to see the mounts inside the jail you can still do<br>
> cat /proc/<jailed process pid>/mounts<br>
<br>
</span>we dont want rebind mounts at all, they were only an intermediate solution<br></blockquote><div> </div><div>why? what's the problem with rebind mounts?<br></div><div>It work for me TM :)<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
><br>
> it<br>
> runs and loads, i can do mounts and access files inside them using<br>
> normal shell calls. however if is point a jail instance at the<br>
> mountpoint it oops horribly. i suspect that i am either using vfs wrong<br>
> or am missing locking/ref-counting somewhere. i'll throw the code onto<br>
> github later today or tomorrow and post the link. maybe someone with<br>
> more knowledge of vfs can help fix it.<br>
><br>
> what problem are you fixing with jailfs? (real question/to be sure there<br>
> is no simpler solution)<br>
><br>
<br>
</span>jailfs is similar overlayfs as it has a lower dir that we overlay but<br>
now with changes but with a set of filter rules ... consider it like a<br>
firewall for file i/o<br></blockquote><div><br></div><div>My question is what features does jailfs provides that you can't do now?<br></div><div>I'm not writing that to criticize or discourage you, just want to know ;)<br></div><div><br></div><div>In any case thanks for your work<br></div></div><br></div><div class="gmail_extra">Etienne<br></div></div>