* Running untrusted code as root in a `guix system vm`?
@ 2023-12-29 23:40 Ben Weinstein-Raun
2024-02-15 16:56 ` Simon Tournier
0 siblings, 1 reply; 2+ messages in thread
From: Ben Weinstein-Raun @ 2023-12-29 23:40 UTC (permalink / raw)
To: help-guix
[-- Attachment #1: Type: text/plain, Size: 474 bytes --]
Hello!
I'm considering running some software inside a VM created using `guix
system vm`. The easiest thing to do would be to run the virtualized
software as root. Normally I wouldn't think twice about that, but iiuc
the guest will have the host's /store mounted. Am I right that this
should make me nervous about running untrusted things as root in the VM?
Or is there some trick by which a root process in the VM is prevented
from destructively changing /store?
Thanks!
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 249 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Running untrusted code as root in a `guix system vm`?
2023-12-29 23:40 Running untrusted code as root in a `guix system vm`? Ben Weinstein-Raun
@ 2024-02-15 16:56 ` Simon Tournier
0 siblings, 0 replies; 2+ messages in thread
From: Simon Tournier @ 2024-02-15 16:56 UTC (permalink / raw)
To: Ben Weinstein-Raun, help-guix
Hi,
On ven., 29 déc. 2023 at 23:40, Ben Weinstein-Raun <root@benwr.net> wrote:
> I'm considering running some software inside a VM created using `guix
> system vm`. The easiest thing to do would be to run the virtualized
> software as root. Normally I wouldn't think twice about that, but iiuc
> the guest will have the host's /store mounted. Am I right that this
> should make me nervous about running untrusted things as root in the VM?
> Or is there some trick by which a root process in the VM is prevented
> from destructively changing /store?
What do you mean by “destructively changing /store”?
Cheers,
simon
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-02-15 17:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-29 23:40 Running untrusted code as root in a `guix system vm`? Ben Weinstein-Raun
2024-02-15 16:56 ` Simon Tournier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).