From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Thompson, David" Subject: Re: Running guix-daemon as an unprivileged user (Was: [PATCH] syscalls: setns: Skip binding if there is no such C function.) Date: Mon, 17 Aug 2015 11:25:07 -0400 Message-ID: References: <20150817033358.580a0cdc@openmailbox.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34113) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRMHg-0003BF-Mj for guix-devel@gnu.org; Mon, 17 Aug 2015 11:25:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZRMHc-00049D-5B for guix-devel@gnu.org; Mon, 17 Aug 2015 11:25:12 -0400 Received: from mail-yk0-f169.google.com ([209.85.160.169]:34239) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRMHc-00048Z-29 for guix-devel@gnu.org; Mon, 17 Aug 2015 11:25:08 -0400 Received: by ykdt205 with SMTP id t205so129771533ykd.1 for ; Mon, 17 Aug 2015 08:25:07 -0700 (PDT) In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: =?UTF-8?B?Q2xhZXMgV2FsbGluICjpn4vlmInoqqAp?= Cc: guix-devel , David Thompson On Mon, Aug 17, 2015 at 11:16 AM, Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA=A0= ) wrote: > On Mon, Aug 17, 2015 at 4:34 PM, Thompson, David > wrote: >> On Mon, Aug 17, 2015 at 4:33 AM, Eric Bavier wrote: >>> On Mon, 17 Aug 2015 14:45:28 +0200 >>> Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA=A0) wrote: > >>>> https://www.gnu.org/software/guix/manual/guix.html#Build-Environment-S= etup >>>> >>>> "If you are installing Guix as an unprivileged user, it is still >>>> possible to run guix-daemon provided you pass --disable-chroot." >>>> >>> >>> I have experimented with this a bit lately. It works to some extent, >>> but I have had to apply a few patches to some package recipes. Some >>> packages have failing tests (where presumably they would pass or be >>> skipped in the chroot), which I have disabled for the time being just >>> to move along. >> >> I think that to really make unprivileged use of Guix work acceptably, >> we need to use the user namespaces feature first introduced in Linux >> 3.8. This would allow unprivileged users to build software in the >> same type of isolated environments that are used when running the >> daemon as root. > > > Working at all is acceptable to me. > > Do namespaces really work for non-root? That's more awesome than I > expected. But without being able to point out how, it sounds to me > like it could easily be a privilege escalation waiting to happen, > unless you do it as compartmentalized as the Hurd does it ... which > Linux won't. Yes, user namespaces can be created by unprivileged users. The user that created the namespace then has root in the context of the new namespace, which allows for creating all of the other types of namespaces. There's been some bumps along the way, such as a security bug with groups that prompted the addition of the /proc//setgroups file in Linux 3.19 (I think) that has since been backported to earlier kernel releases, the oldest I know of being 3.13. But overall, this feature is very good and using it for Guix would allow for the unprivileged daemon to take advantage of almost all of the isolation techniques used by the privileged daemon. - Dave