search

tailhook / unshare

The low-level linux containers creation library for rust
Apache License 2.0
124 stars 27 forks source link

Support additional isolation features #12

Open nbraud opened 5 years ago

nbraud commented 5 years ago

Would you consider PRs that add support for Linux sandboxing features that are complementary to namespaces, such as MAC (via AppArmor, for example) and seccomp filters?

This would enable using unshare to build safe(r) sandboxes, by limiting the exposed attack surface on the rest of the system, esp. the kernel.

tailhook commented 5 years ago

Probably yes, if this either requires complex initialization in child process before exec, or has complex interactions between current features and MAC (I'm not familiar with how MACs work). We may put it under a feature gate if it requires new dependencies, though.

Integrating seccomp is on my to do list, but I'm not going to do it soon. So yes, contributions are welcome.

pwFoo commented 4 years ago

I play with / build a minimal container runtime host without featues like AppAmor or SELinux. At the moment I use crun / runc as runtime. Also played a little bit with busybox unshare, but it was possible to break out of the namespaced environment?

Is there a security feature implemented to prevent access to /sys and /proc from inside of a container created with your unshare?

tailhook commented 4 years ago

Is there a security feature implemented to prevent access to /sys and /proc from inside of a container created with your unshare?

Not exactly. But you can either change the user or change the user and create a user namespace (to become root in a new namespace) or you can use libmount (or any other mount sycall wrapper) to hide/configure these directories.

Sorry for late reply.