Conversation

Notices

1. Embed this notice
   Wolf480pl (wolf480pl@mstdn.io)'s status on Tuesday, 26-Nov-2024 22:14:49 JST Wolf480pl

   • Haelwenn /элвэн/ :triskell:
   • Quad

   @quad @lanodan
   huh, TIL bwrap exists.

   Is it basically like `unshare` that works without having root?

   So you'd first switch to service-specific user, then run bwrap?

   How would you start the service on boot? Have init switch user and call bwrap? Or the old ugly @reboot in user's crontab?

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Tuesday, 26-Nov-2024 22:14:49 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Quad

     @wolf480pl @quad Yeah either switch to the service user in advance or use the --uid option.

     Do would you start the service on boot?

     Just use the normal services files of your host, maybe with a wrapping script if you hate long commands or it's something like systemd where variables/functions inside the command likely aren't a thing.

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Tuesday, 26-Nov-2024 22:22:31 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Quad

     @wolf480pl @quad I've never used systemd other than fixing broken debian installs, so I can't say but I don't thing it comes any close to bwrap.

     Like can you isolate /dev, /sys, /proc with systemd? Or get a tmpfs (which is specially neat for throwaway containers).

   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Tuesday, 26-Nov-2024 22:22:32 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • Quad

     @lanodan @quad
     hmm ok...

     so it can do all the namespace-y privilege-dropy bind-mounty stuff, but it doesn't do anything related to images, you just use existing directories in the filesystem?

     Assuming I'm ok with systemd, is there any reason to use bwrap over systemd's Protect* / RootDirectory / BindPath / etc?

   • Embed this notice
     rakoo (rakoo@blah.rako.space)'s status on Tuesday, 26-Nov-2024 23:11:59 JST rakoo

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • Quad
     @lanodan
     
     yup, that's one of the design goals: https://0pointer.de/blog/projects/security.html
     
     @quad @wolf480pl
     Haelwenn /элвэн/ :triskell: likes this.