ioi / isolate

Sandbox for securely executing untrusted programs
Other
1.05k stars 157 forks source link

Question: subdirectory mounting #69

Closed horacekj closed 5 years ago

horacekj commented 5 years ago

Hello, I would like to access file /etc/passwd and directory /etc/alternatives in the sandbox. /etc/passwd should be completely arbitrary file (not real /etc/passwd), however, /etc/alternatives should refer to the real system-wide /etc/alternatives path.

I tried arguments like --dir=/etc=my_arbitrary_dir_with_passwd_file, --dir=/etc/alternatives, however, they do not seem to work. In this situation, /etc/alternatives is not accessible, because the /etc is already mounted from fake directory, when I change the order of arguments, obviously it does not work too. I thought about symlinks or hardlinks in my_arbitrary_dir_with_passwd_file, but I didn't come to any meaningful solution. Could you please provide me an advice on how to deal with this situation?

Thanks.

gollux commented 5 years ago

You can try bind-mounting /etc to a different directory in your system and then refer to that directory in isolate's rules.

horacekj commented 5 years ago

I wil try it, thanks.

horacekj commented 5 years ago
isolate -b 1 --dir=/etc=/tmp/box/1/etc:rw --dir=/etc/alternatives=/opt/etc/alternatives -c/box --run /box/run
Return code: 2
Stdout: 
Stderr: Cannot mount /opt/etc/alternatives on etc/alternatives: No such file or directory
$ mount | grep opt
/dev/vda1 on /opt/etc type ext4 (rw,relatime,errors=remount-ro,data=ordered)
$ ll /opt/etc/alternatives/
total 20
drwxr-xr-x   2 root root  4096 Sep 18 20:15 ./
drwxr-xr-x 108 root root 12288 Sep 18 20:25 ../
lrwxrwxrwx   1 root root    24 Oct 22  2015 aptitude -> /usr/bin/aptitude-curses*
...

Could you provide any help please?

bblackham commented 5 years ago

You need to create the mount point directory i.e. /tmp/box/1/etc/alternatives/

horacekj commented 5 years ago

OMG, sure. Thanks. :)