| 1 |
On Fri, Sep 22, 2017 at 7:43 PM, James McMechan <james_mcmechan@×××××××.com> |
| 2 |
wrote: |
| 3 |
|
| 4 |
> Hello, |
| 5 |
> I thought a example of how a overlay sandbox could work was in order. |
| 6 |
> |
| 7 |
> ### |
| 8 |
> # load the overlayfs filesystem for this test |
| 9 |
> modprobe overlay |
| 10 |
> |
| 11 |
> # make the directories for the test |
| 12 |
> mkdir -p /var/tmp/upper /var/tmp/work /mnt/gentoo |
| 13 |
> |
| 14 |
> # now create a separate mount namespace non-persistent |
| 15 |
> unshare -m bash |
| 16 |
> |
| 17 |
> # setup the overlay |
| 18 |
> mount -toverlay -oupperdir=/var/tmp/upper/,workdir=/var/tmp/work/,lowerdir=/ |
| 19 |
> overlay /mnt/gentoo/ |
| 20 |
> |
| 21 |
> # since I don't care about protecting /var/tmp/portage |
| 22 |
> # put the original on top of the overlay for better performance maybe? |
| 23 |
> mount -o bind /var/tmp/portage /mnt/gentoo/var/tmp/portage |
| 24 |
> |
| 25 |
> # then like the handbook |
| 26 |
> cd /mnt/gentoo |
| 27 |
> mount -t proc proc proc |
| 28 |
> mount --rbind /sys sys |
| 29 |
> mount --rbind /dev dev |
| 30 |
> |
| 31 |
> #finally change into the protected sandbox |
| 32 |
> chroot . bash |
| 33 |
> |
| 34 |
> # mess up the system |
| 35 |
> |
| 36 |
|
| 37 |
> exit # the chroot |
| 38 |
> exit # the unshare |
| 39 |
> ### done. |
| 40 |
> |
| 41 |
> This version allows the sandbox to work with the special files in /dev, |
| 42 |
> /proc, /sys |
| 43 |
> other options are available for example a second separate dev/pts and |
| 44 |
> dev/shm submounts |
| 45 |
> |
| 46 |
> When you exit the chroot and then the unshare, the /var/tmp/upper |
| 47 |
> directory will contain all the changes made while in the chroot. |
| 48 |
> |
| 49 |
|
| 50 |
I'm not quite grasping how this informs me of violations though. |
| 51 |
|
| 52 |
Like inside of the chroot lets say I read /etc/foo and then modify it (via |
| 53 |
something like a sed call.) |
| 54 |
In this implementation /etc/foo is available (because / is lowerdir?) but |
| 55 |
my writes will end up in /var/tmp/upper. |
| 56 |
|
| 57 |
So by simple inspection of /var/tmp/upper I can detect a violation |
| 58 |
occurred...but I don't get any information as to what caused it; right? I'm |
| 59 |
sure in trivial cases (sed $FOO) its easy to figure out but other cases its |
| 60 |
a lot more complicated to determine which portion of the build is the |
| 61 |
culprit. That is why the tracing portion is so useful. A thing tries to do |
| 62 |
the bad thing and it fails. |
| 63 |
|
| 64 |
We could try forcing failures (say, by not having / mounted as lowerdir, so |
| 65 |
syscalls against the rootfs would just fail as E_NOENT) but then we are |
| 66 |
still stuck with the tricky part; which is that sometimes things *do* need |
| 67 |
to read / write from the rootfs and the sandbox add* API is available to do |
| 68 |
that. How would we implement something like that here? |
| 69 |
|
| 70 |
-A |
| 71 |
|
| 72 |
|
| 73 |
> Enjoy, |
| 74 |
> |
| 75 |
> Jim McMechan |
| 76 |
> |
| 77 |
> |
Archives