TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Implement unprivileged chroot

231 pointsby 0mpalmost 4 years ago

7 comments

EdSchoutenalmost 4 years ago
FreeBSD already supported something like this effectively, but in my opinion better way.<p>You can call cap_enter(), which disables open(), unlink(), mkdir(), etc. entirely. You can, however, still use openat(), unlinkat(), mkdirat() with relative paths that expand to a location underneath a directory file descriptor. This achieves the same thing, except that you can now have as many chroots as you want. Not just one.<p>Unfortunately, the idea never caught on, because virtually no software on UNIX uses the *at() functions. Also: the non-*at() functions are still available as symbols, meaning that you can&#x27;t perform simple compile-time checks to ensure that you application works properly when this form of sandboxing is enabled. Turns out that off-the-shelf software (e.g., libraries) end up misbehaving in unpredictable ways if you disable ~50% of the POSIX API.<p>It&#x27;s a shame, because this feature effectively requires you to treat the file system in an object oriented&#x2F;dependency injected way. Pretty good from a reusability&#x2F;testability perspective.
评论 #27918404 未加载
评论 #27918530 未加载
评论 #27924440 未加载
评论 #27920643 未加载
评论 #27917961 未加载
评论 #27918922 未加载
评论 #27919025 未加载
stabblesalmost 4 years ago
On many linux distro&#x27;s you can already do this with user namespaces:<p><pre><code> $ mkdir rootfs $ docker export $(docker create ubuntu:20.04) | tar -C rootfs -xf - $ unshare -r chroot rootfs bash # ls bin dev home ... </code></pre> Very often when you use chroot you also want unprivileged mounts, in particular overlay mounts if you don&#x27;t want to mutate the underlying rootfs. You can do that with mount namespaces: `unshare -rm`, but you need Linux kernel 5.13 (or a distro with a patched kernel like Ubuntu) to allow unpriviliged overlayfs.
评论 #27917530 未加载
评论 #27918726 未加载
marcodiegoalmost 4 years ago
*BSD have been quite innovative recently. The pledge and unveil syscalls, although achievable by other means on linux, are very simple and effective for what they do. I don&#x27;t know a way on linux to use a system on a directory without being root; even if possible I&#x27;d still need root to mount --bind some dirs, but definitely something I&#x27;d like to do.<p>I don&#x27;t think containers should be needed for that.
评论 #27918748 未加载
评论 #27917693 未加载
geofftalmost 4 years ago
I wish Linux would do this. Patches are available: <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;849125&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;849125&#x2F;</a><p>Yes, you can do this on Linux with a user namespace, but a user namespace changes the view of user accounts. You have to map every usable UID inside the namespace to a UID you control outside the namespace. At best, you can map a range of UIDs you control to &quot;real&quot; users (root, 1000, etc.) inside the namespace, but they won&#x27;t be real users outside the namespace. If you&#x27;re on a multi-user system, seeing other people&#x27;s files as owned by &quot;nobody&quot; is confusing.<p>It should be enough to use NO_NEW_PRIVS mode, meaning setuid transitions are not allowed. Then it doesn&#x27;t matter what user IDs you see inside the chroot.<p>In fact, back when Linux introduced the NO_NEW_PRIVS flag (almost a decade ago!), this was one of the motivating use cases.
thenoblesunfishalmost 4 years ago
For those, like me, lacking context, what are the implications of this?
评论 #27917454 未加载
评论 #27917456 未加载
评论 #27919239 未加载
评论 #27917434 未加载
krylonalmost 4 years ago
The commit message does NOT indicate when this will be available to mere mortals like myself.<p>Can someone enlighten me if this will be part of FreeBSD 14, or if there is a chance it will become available earlier, perhaps with FreeBSD 13.1?<p>EDIT: The commit message does NOT indicate etc. Silly me.
评论 #27918184 未加载
HPsquaredalmost 4 years ago
In Linux there&#x27;s &quot;PRoot&quot; - used by Termux on Android to provide userspace chroot-like functionality (can run Debian, for instance).<p><a href="https:&#x2F;&#x2F;proot-me.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;proot-me.github.io&#x2F;</a>