From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?B?Q2xhZXMgV2FsbGluICjpn4vlmInoqqAp?= Subject: Re: Running guix-daemon as an unprivileged user (Was: [PATCH] syscalls: setns: Skip binding if there is no such C function.) Date: Mon, 17 Aug 2015 17:35:05 +0200 Message-ID: References: <20150817033358.580a0cdc@openmailbox.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:36948) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRMRS-0007FE-E8 for guix-devel@gnu.org; Mon, 17 Aug 2015 11:35:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZRMRR-0001GU-FB for guix-devel@gnu.org; Mon, 17 Aug 2015 11:35:18 -0400 In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: "Thompson, David" Cc: guix-devel , David Thompson On Mon, Aug 17, 2015 at 5:25 PM, Thompson, David wrote: > On Mon, Aug 17, 2015 at 11:16 AM, Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA= =A0) > wrote: >>> I think that to really make unprivileged use of Guix work acceptably, >>> we need to use the user namespaces feature first introduced in Linux >>> 3.8. This would allow unprivileged users to build software in the >>> same type of isolated environments that are used when running the >>> daemon as root. >> >> >> Working at all is acceptable to me. >> >> Do namespaces really work for non-root? That's more awesome than I >> expected. But without being able to point out how, it sounds to me >> like it could easily be a privilege escalation waiting to happen, >> unless you do it as compartmentalized as the Hurd does it ... which >> Linux won't. > > Yes, user namespaces can be created by unprivileged users. The user > that created the namespace then has root in the context of the new > namespace, which allows for creating all of the other types of > namespaces. There's been some bumps along the way, such as a security > bug with groups that prompted the addition of the > /proc//setgroups file in Linux 3.19 (I think) that has since been > backported to earlier kernel releases, the oldest I know of being > 3.13. But overall, this feature is very good and using it for Guix > would allow for the unprivileged daemon to take advantage of almost > all of the isolation techniques used by the privileged daemon. That is really awesome for all kinds of things. Wow. On this system though, setns doesn't exist, so I'm happy to get even a stow on steroids working, which actually seems to be the case at this point. Thank you all guix for making this awesome system! --=20 /c