Minijail build for Pyra PND system

Discussion in 'Pyra OS (Debian GNU/Linux)' started by Shlee, Oct 19, 2016.

  1. Shlee

    Shlee Still Fresh

    Joined:
    Apr 27, 2016
    Messages:
    56


    Hey, this is a beautiful tool and I'd love to see this used earlier in the design of the new Pyra PND system.

    Mount the PND and load the binary within a user/id namespace minijail. this takes advantage of the new kernel features and allows the use of seccomp security for applications that support it.

    This kind of tool shouldn't cause any major performance issues, but I'm keen to see if any of the dev team are interested in some security focus :)

    cite:
    https://www.chromium.org/chromium-os/developer-guide/chromium-os-sandboxing
    https://lwn.net/Articles/700557/
     
    Tags:
    FBnil and ClockworkCoder like this.
  2. TrashyMG

    TrashyMG Sarcasm Dispenser Staff Member

    Joined:
    Jan 18, 2010
    Messages:
    10,167
  3. Magic Sam

    Magic Sam Forever Homebrew

    Joined:
    Aug 10, 2007
    Messages:
    2,045
    Location:
    Innsmouth, MA
    Hi all :)

    @Shlee : minijail looks like an interesting project, thanks for sharing !

    I wondered elsewhere on the boards whether Docker would run on the Pandora (with armhf support) or not...

    I guess minijail would be a lighter alternative to Docker in our case. Opinions ?

    Cheers, Magic Sam
     
    ClockworkCoder likes this.
  4. Haraldur

    Haraldur Very Active Member

    Joined:
    Mar 12, 2015
    Messages:
    270
    I have not watched the video, but there are other options to consider as well: firejail and bubblewrap, that I know of. I like that this is being worked on by so many different projects, as I think that the future of a mass-market GNU/Linux desktop system is to distribute non-system software like Windows: standalone executables (possibly in folders with data and libraries) downloaded from the web from perhaps-untrustworthy sources. Give me convenience, or give me death!
     
  5. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,511
    Location:
    Somewhere off the coast of the EU
    This seems to involve chrooting, so that would be incompatible with projects such as wxpython or timidity, or speaking technically, other DBPs trying to discover the mount point of such projects.

    But it might be useful for trying out DBPs though. Would be better if it could tell you about attempts to break out of its jail though, a little like you can control permissions in cyanogen though, just chrooting and hiding most of the ps table won't tell you that.
     
  6. slaeshjag

    slaeshjag ¯\_(ツ)_/¯

    Joined:
    Apr 8, 2010
    Messages:
    2,687
    Location:
    ~Stockholm, Sweden
    While I can see the appeal of running such software in a jail, I'm not yet convinced that integration will work competently. If anyone have an idea of how to implementing it in practice rather than just listing technologies, I'd consider adding it as a configuration option for those who wants it. But system-wide access and integration close to that you get with it installed right onto your system drive is kinda of a big feature for me.

    The general requirement is that it must not require root access to start the jail, dbp-run does not have that, and I'd muchly prefer not to suid it.
     
    bzar, ClockworkCoder and ible like this.
  7. Haraldur

    Haraldur Very Active Member

    Joined:
    Mar 12, 2015
    Messages:
    270
    I have only used firejail, but that does not require root access. Assuming there is some command-line program for running DBPs, then the usage would be: 'firejail <options> DBP_runner audacious.dbp' (though the success of that depends on what the DBP_runner needs to access, as firejail might need to be told to give extra permissions). I have little idea of how DBP works, but if it creates a virtual file system and then just runs the main executable, then just putting 'firejail <options>' in front could suffice (though some programs may need specific options for specific permissions).

    firejail is the sandbox suggested on the AppImage website (as AppImage does not have a built-in sandbox as yet).
     
  8. slaeshjag

    slaeshjag ¯\_(ツ)_/¯

    Joined:
    Apr 8, 2010
    Messages:
    2,687
    Location:
    ~Stockholm, Sweden
    dbp-run will send a bunch of commands to dbpd over dbus, which will set up the aufs and mount the image. After that, it'll chdir into the aufs root and execute a given binary using a runscript in /etc. Any kind of jailing would likely have to happen in the run script.
     
    levi likes this.
  9. Askarus

    Askarus Hardcore Member

    Joined:
    Sep 28, 2011
    Messages:
    4,167
    Location:
    Germany
    Minijail: Running untrusted programs safely.

    That says it all. I don't trust any DBP uploaded here.
     

Share This Page

Loading...