Re: Running guix-daemon as an unprivileged user (Was: [PATCH] syscalls: setns: Skip binding if there is no such C function.)

["Claes Wallin (韋嘉誠)" <gnu@clacke.user.lysator.liu.se>]

On Mon, Aug 17, 2015 at 5:25 PM, Thompson, David
<dthompson2@worcester.edu> wrote:
> On Mon, Aug 17, 2015 at 11:16 AM, Claes Wallin (韋嘉誠)
> <gnu@clacke.user.lysator.liu.se> wrote:

>>> I think that to really make unprivileged use of Guix work acceptably,
>>> we need to use the user namespaces feature first introduced in Linux
>>> 3.8.  This would allow unprivileged users to build software in the
>>> same type of isolated environments that are used when running the
>>> daemon as root.
>>
>>
>> Working at all is acceptable to me.
>>
>> Do namespaces really work for non-root? That's more awesome than I
>> expected. But without being able to point out how, it sounds to me
>> like it could easily be a privilege escalation waiting to happen,
>> unless you do it as compartmentalized as the Hurd does it ... which
>> Linux won't.
>
> Yes, user namespaces can be created by unprivileged users. The user
> that created the namespace then has root in the context of the new
> namespace, which allows for creating all of the other types of
> namespaces.  There's been some bumps along the way, such as a security
> bug with groups that prompted the addition of the
> /proc/<pid>/setgroups file in Linux 3.19 (I think) that has since been
> backported to earlier kernel releases, the oldest I know of being
> 3.13.  But overall, this feature is very good and using it for Guix
> would allow for the unprivileged daemon to take advantage of almost
> all of the isolation techniques used by the privileged daemon.

That is really awesome for all kinds of things. Wow.

On this system though, setns doesn't exist, so I'm happy to get even a
stow on steroids working, which actually seems to be the case at this
point. Thank you all guix for making this awesome system!

-- 
   /c