search

cmusatyalab / opendiamond

Interactive search of non-indexed data
http://diamond.cs.cmu.edu/
Eclipse Public License 1.0
19 stars 9 forks source link

Run filters in a sandbox #19

Open bgilbert opened 11 years ago

bgilbert commented 11 years ago

Filters need to access stdio, launch helper programs, and load arbitrary libraries. They should not be able to make network connections, write files outside TMPDIR, read arbitrary files, or elevate permissions. In particular, they should not be able to modify cgroups.

(ImageJ also needs to talk with its Xvfb.)

Investigate SELinux, Linux Containers, or seccomp.

jaharkes commented 7 years ago

Got one step closer to this in the opendiamond-8.1.0 release by accepting docker containers as a way to wrap and execute Diamond filters. Once all filters have been converted we can disable support for executing 'native' filter code and finally start tightening down which resources are available to the containers.

btw. ImageJ simply installs and runs Xvfb in the same container as the imagejfind filter.