all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* Unprivileged /gnu/store with PRoot
@ 2017-05-12 15:53 Ludovic Courtès
  2017-05-12 16:20 ` Alex Sassmannshausen
                   ` (5 more replies)
  0 siblings, 6 replies; 12+ messages in thread
From: Ludovic Courtès @ 2017-05-12 15:53 UTC (permalink / raw)
  To: guix-devel

Hello Guix!

In hostile environments (read: machines that lack Guix and where you’re
not root, such as HPC clusters), it can be hard to manage software with
Guix.

We can use ‘guix pack’ to build a bundle on one machine and ship it to
the target machine.  But then, on the target machine, we need to be able
to “map” the pack’s root directory to the root directory of the
processes we run.

When user namespaces are enabled, this can be achieved with ‘unshare’
and ‘chroot’ as shown at
<https://www.gnu.org/software/guix/news/creating-bundles-with-guix-pack.html>.
However user namespaces are often disabled by distros for lack of
confidence in their security properties¹.

One way to work around the problem is to use PRoot, a ptrace(2)-based
tool to virtualize the file system².  With the ‘proot-static’ package I
just pushed, one can run, say, hwloc, on such a hostile machine by
sending locally-created packs as well as ‘proot’:

  scp $(guix build proot-static)/bin/proot hostile:
  scp $(guix pack hwloc -S /bin=bin) hostile:hwloc.tgz

and then on the hostile machine:

  mkdir ~/.local
  cd ~/.local
  tar xf ~/hwloc.tgz
  cd
  ./proot -b .local:/ /bin/lstopo

where “proot -b .local:/” essentially “bind-mounts” ~/.local to /.

Pretty cool no?  :-)

PRoot adds overhead since it has to intercept every syscall.  However,
for a mostly computational process, it should not be much of a problem.

Ludo’.

¹ See for instance
  <http://rhelblog.redhat.com/2015/07/07/whats-next-for-containers-user-namespaces/>
  and the recent AF_PACKET vulnerability
  <https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html>.

² https://github.com/proot-me/PRoot

^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2017-07-16 16:09 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-12 15:53 Unprivileged /gnu/store with PRoot Ludovic Courtès
2017-05-12 16:20 ` Alex Sassmannshausen
2017-05-12 21:28 ` Hartmut Goebel
2017-05-13  5:38 ` Unprivileged /gnu/store with PRoot - or relocate Pjotr Prins
2017-05-13 14:12   ` Ludovic Courtès
2017-05-13  7:04 ` Unprivileged /gnu/store with PRoot Maxim Cournoyer
2017-05-13 14:02   ` Ludovic Courtès
2017-06-08 15:29 ` Ricardo Wurmus
2017-06-09  8:09   ` Ludovic Courtès
2017-07-16 12:35 ` Pjotr Prins
2017-07-16 12:51   ` Pjotr Prins
2017-07-16 16:09     ` Pjotr Prins

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.