Show HN: FSSB – A filesystem sandbox for Linux
1–10 of 21 posts
Re: Show HN: FSSB – A filesystem sandbox for Linux
#2> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet).
I don't think sandboxing is an appropriate solutionto this. Especially just filesystem sandboxing. This does nothing to prevent security exploits via any means.
Also how does this compare to chroot?
Re: Show HN: FSSB – A filesystem sandbox for Linux
#3> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just filesystem sandboxing. This does nothing to prevent security exploits via any means. Also how does this compare to chroot?
It definitely doesn't make it safe, but it does allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat!
chroot is completely different because it completely isolates a process from the rest of the filesystem. This is more like, well, a sandbox or overlay.
Re: Show HN: FSSB – A filesystem sandbox for Linux
#4I can't even tell what this does. I just woke up but is this like capsicum on freebsd, https://m.youtube.com/watch?v=raNx9L4VH2k, or jails in the FS, or both?
Clearly I need to wake up.
Re: Show HN: FSSB – A filesystem sandbox for Linux
#5Use of ptrace will incur a huge performance penalty. Why not just using a mount namespace and using an overlay filesystem?
Re: Show HN: FSSB – A filesystem sandbox for Linux
#6There was a project which pursue a similar strategy: https://github.com/tsgates/mbox
Re: Show HN: FSSB – A filesystem sandbox for Linux
#7> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just filesystem sandboxing. This does nothing to prevent security exploits via any means. Also how does this compare to chroot?
It definitely doesn't make it safe, but it does allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat! chroot is completely different because it completely isolates a process from the rest of the filesystem. This is more like, well, a sandbox or overlay.
it could hardened it with seccomp filter.
Re: Show HN: FSSB – A filesystem sandbox for Linux
#8Interesting and cool, but I would be careful with it.
It appears to intercept a fixed list of syscalls, so it may not be intercepting all of them that are relevant. I don't think, for example, it's intercepting truncate(), so a process sandboxed in this way could still wreak a little havoc.
Re: Show HN: FSSB – A filesystem sandbox for Linux
#9I can't even tell what this does. I just woke up but is this like capsicum on freebsd, https://m.youtube.com/watch?v=raNx9L4VH2k , or jails in the FS, or both? Clearly I need to wake up.
It's intercepting specific system calls via ptrace() and dynamically changing the arguments passed to them. I believe freebsd has ptrace.
Re: Show HN: FSSB – A filesystem sandbox for Linux
#10This is essentially the same thing as either of:
- Linux containers on a read only FS
- weaker specialised version of seccomp
- some similar preload intercept as in e.g. Gentoo sandbox (insecure, used more to catch mistakes)
- Ptrace syscall hijack (Ptrace itself is notoriously insecure)
Neither is particularly impressive. You also get support by one random guy on the Internet.
Use a real virtual machine instead please.