Notices by Wolf480pl (wolf480pl@mstdn.io), page 10

uhh... maybe sth like this:

```
#!/bin/sh

dir="$1"

if ! [ -d "$dir" ]; then
echo "not a directory: $dir" >&2
fi

user=$(stat --printf="%U" "$dir")

exec sudo -u "$user" /usr/bin/git-upload-pack "$@"
```

and then

git fetch --upload-pack=~/bin/sudo-upload-pack <remote>

but the part about automagically figuring out the user feels sus to me...

Ok so apparently cloning/fetching git repos owned by a different user on a local filesystem is not safe:

https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8

so... how do y'all get commits from the user a service runs as to the user that has an ssh key and can push to remotes?

@piggo does mastodon have that? or is this an everything-but-mastodon feature?

@piggo looks like mstdn.io doesn't use glitch soc, and upstream mastodon doesn't have markdown :(

which sucks

but at the same time, markdown was designed so that you can look at it as raw text and it still makes sense, so like

I think this is still better than not trying to use markdown

@piggo mastodon treats foreigners better than its own users

Some people are like "don't use GPG, it's outdated, insecure, hard to use, and comes with a footgun colllection" and like yeah sure, but what do they propose instead?

"separate tool for every usecase" kinda misses the point of what gpg was.

1/

I'm starting to think the problem with unprivileged userNS is that most linux programmers / admins don't understand unprivileged userNS

@lanodan @quad

$ /bin/unshare -U -p -m -n -f --mount-proc --keep-caps
$ nft list ruleset
$ nft add table foo
$ nft list ruleset
table ip foo {
}
$

@lanodan @quad
(might require having used nft on the host first, to load the module)

@lanodan @quad
add `-n` for net namespace

@domi friendship ended with inkscape, now vim is my faviourite svg editor /hj

@lanodan @quad

$ ls -l /bin/unshare
-rwxr-xr-x 1 root root 43256 2023-08-17 /bin/unshare
$ getcap /bin/unshare
$ grep Cap /proc/self/status
CapInh: 0000000800000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 000001ffffffffff
CapAmb: 0000000000000000
$ /bin/unshare -U -p -m -f --mount-proc --keep-caps grep Cap /proc/self/status
CapInh: 000001ffffffffff
CapPrm: 000001ffffffffff
CapEff: 000001ffffffffff
CapBnd: 000001ffffffffff
CapAmb: 000001ffffffffff
$

@lanodan @quad
No.
If unprivileged userNS is enabled, *any* user can just:
- clone(CLONE_NEWUSER), getting a fresh userNS in which it has all the capabilities
- unshare(CLONE_NEWNET), getting a new netNS, which belongs to its own userNS

any unprivileged process that does that ends up in a new netNS in which it as CAP_NET_ADMIN.

That netNS isn't used by anything else, so it can't really affect any network traffic going through the system.

But it gets its own copy of iptables it can mess with.

@lanodan @quad
AFAIU if there is a vulnerability in iptables, then in most cases, enabling unprivileged userNS will allow any user to exploit it, whether you have docker or bwrap installed or not.

So I'm guessing bwrap uses userNS but only as a privileged user (it has suid, right?) so that you can disable unprivileged userNS system-wide?

@lanodan @quad
"unsuitable" ?
I meant that bubblewrap claims to give you unprivileged containers without relying on userNS, because userNS is scary and exposes new kernel bugs

@lanodan @quad
hmm ok...

so it can do all the namespace-y privilege-dropy bind-mounty stuff, but it doesn't do anything related to images, you just use existing directories in the filesystem?

Assuming I'm ok with systemd, is there any reason to use bwrap over systemd's Protect* / RootDirectory / BindPath / etc?

@quad @lanodan
uh.. I thought we're talking about
https://github.com/containers/bubblewrap

and the README there says bwrap's explicit purpose is to *not* use unprivileged userNS...

if I'm running as a privileged user I'd just use unshare directly...

@quad @lanodan
huh, TIL bwrap exists.

Is it basically like `unshare` that works without having root?

So you'd first switch to service-specific user, then run bwrap?

How would you start the service on boot? Have init switch user and call bwrap? Or the old ugly @reboot in user's crontab?

@grumpasaurus @ryantownsend
I mean, if you tell people what kubernetes is for, and they realize they have one computer... or many computers but they want to run the exact same programs on each of them, then they might realize they don't need kubernetes.

@ryantownsend @grumpasaurus
Also, I think a large problem is that while we teach people to Kubernetes and stuff, we don't teach them why, and when.

It took me a few years of hating k8s from sidelines, and then a couple years of working with k8s at $dayjob, to finally figure out what it's for:

It's for when you have multiple programs and multiple computers and you have trouble figuring out which program should run on which computer.

How many companies would avoid k8s if they knew that?