From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pjotr Prins Subject: Re: Unprivileged /gnu/store with PRoot - or relocate Date: Sat, 13 May 2017 07:38:59 +0200 Message-ID: <20170513053859.GA19841@thebird.nl> References: <87d1beoyvi.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:56384) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d9Pm1-0004FW-2g for guix-devel@gnu.org; Sat, 13 May 2017 01:39:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d9Plx-0002i4-V9 for guix-devel@gnu.org; Sat, 13 May 2017 01:39:25 -0400 Received: from mail.thebird.nl ([95.154.246.10]:37777) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d9Plx-0002UM-F4 for guix-devel@gnu.org; Sat, 13 May 2017 01:39:21 -0400 Content-Disposition: inline In-Reply-To: <87d1beoyvi.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic Court??s Cc: guix-devel I explored this and actually built Nix/Guix on proot in the past for the same reasons https://github.com/pjotrp/nix-no-root Mind, it *is* slow. That is why I came up with relocatable Guix which works much better. No performance loss. Just an extra installation step. Relocatable Guix works great, but it requires effort to make it user friendly. We can automate creating relocatable packages with guix pack. All it needs is an additional installer that rewrites the paths. The other limitation is that the installer prefix can be no longer than ~50 characters because it gobbles up the Guix store path + hash. I have written all the code for that. The installer is fast. Anyone interested in that type of solution? We can make it work, even as automated builds. I think it would be great for HPC and can even be part of non-root packagers, such as brew and conda. Pj. On Fri, May 12, 2017 at 05:53:21PM +0200, Ludovic Court??s wrote: > Hello Guix! > > In hostile environments (read: machines that lack Guix and where you???re > not root, such as HPC clusters), it can be hard to manage software with > Guix. > > We can use ???guix pack??? to build a bundle on one machine and ship it to > the target machine. But then, on the target machine, we need to be able > to ???map??? the pack???s root directory to the root directory of the > processes we run. > > When user namespaces are enabled, this can be achieved with ???unshare??? > and ???chroot??? as shown at > . > However user namespaces are often disabled by distros for lack of > confidence in their security properties??. > > One way to work around the problem is to use PRoot, a ptrace(2)-based > tool to virtualize the file system??. With the ???proot-static??? package I > just pushed, one can run, say, hwloc, on such a hostile machine by > sending locally-created packs as well as ???proot???: > > scp $(guix build proot-static)/bin/proot hostile: > scp $(guix pack hwloc -S /bin=bin) hostile:hwloc.tgz > > and then on the hostile machine: > > mkdir ~/.local > cd ~/.local > tar xf ~/hwloc.tgz > cd > ./proot -b .local:/ /bin/lstopo > > where ???proot -b .local:/??? essentially ???bind-mounts??? ~/.local to /. > > Pretty cool no? :-) > > PRoot adds overhead since it has to intercept every syscall. However, > for a mostly computational process, it should not be much of a problem. > > Ludo???. > > ?? See for instance > > and the recent AF_PACKET vulnerability > . > > ?? https://github.com/proot-me/PRoot > --