From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?B?Q2xhZXMgV2FsbGluICjpn4vlmInoqqAp?= Subject: Re: Running guix-daemon as an unprivileged user (Was: [PATCH] syscalls: setns: Skip binding if there is no such C function.) Date: Mon, 17 Aug 2015 17:16:54 +0200 Message-ID: References: <20150817033358.580a0cdc@openmailbox.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:60080) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRM9q-0008Ks-6n for guix-devel@gnu.org; Mon, 17 Aug 2015 11:17:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZRM9p-00009Z-2l for guix-devel@gnu.org; Mon, 17 Aug 2015 11:17:06 -0400 In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: "Thompson, David" Cc: guix-devel , David Thompson On Mon, Aug 17, 2015 at 4:34 PM, Thompson, David wrote: > On Mon, Aug 17, 2015 at 4:33 AM, Eric Bavier = wrote: >> On Mon, 17 Aug 2015 14:45:28 +0200 >> Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA=A0) wrote: >>> https://www.gnu.org/software/guix/manual/guix.html#Build-Environment-Se= tup >>> >>> "If you are installing Guix as an unprivileged user, it is still >>> possible to run guix-daemon provided you pass --disable-chroot." >>> >> >> I have experimented with this a bit lately. It works to some extent, >> but I have had to apply a few patches to some package recipes. Some >> packages have failing tests (where presumably they would pass or be >> skipped in the chroot), which I have disabled for the time being just >> to move along. > > I think that to really make unprivileged use of Guix work acceptably, > we need to use the user namespaces feature first introduced in Linux > 3.8. This would allow unprivileged users to build software in the > same type of isolated environments that are used when running the > daemon as root. Working at all is acceptable to me. Do namespaces really work for non-root? That's more awesome than I expected. But without being able to point out how, it sounds to me like it could easily be a privilege escalation waiting to happen, unless you do it as compartmentalized as the Hurd does it ... which Linux won't. --=20 /c