3 ms·

> You will need to let Sandstorm start as root Joke of today, thanks for the laugh.

by antocv 10y ago

geofft 10y ago
What do you run as root that isn't accessible to other users on your system, and why are you deploying Sandstorm on this machine? If it's a single-user machine, any process running at any privilege level can trivially get root by editing ~/.bashrc and aliasing the sudo command.
- antocv 10y ago
  Aliasing the sudo command? Are you serious? I dont even have sudo, let alone if I had it, I wouldnt use its dumb caching of credentials/session or "ask no password" "feature". Just because my system is single-user doesnt mean I run every process with that one user, in fact I run firefox as its own user, chrome has its own, mpd as its own user, nginx is its own user and so on. This is basic security practice. If you seriously think that it is so easy to get root just because you can run a process as a normal user - "by aliasing sudo command", then by all means run everything as root, whats the harm or big deal, right? Why do you even have a user which is non-root? Why cant sandstorm run like lighttpd or nginx - as their own user, requiring no capabilites, in fact even syscalls can be revoked from them with seccomp and they will still work fine. All they need is socket api, file system api ( open close create), and some others, no they dont need to load kernel modules, ptrace or open_file_handle_at and so on.
  - kentonv 10y ago
    nginx usually needs to start as root, in order to bind low-numbered ports, but the worker processes run as non-root. Sandstorm works exactly the same way. nginx can run as completely non-root, if you are OK with high-numbered ports. Sandstorm can too, if you are OK with high-numbered ports and if unprivileged user namespaces are enabled. (It sounds like you actually use UID separation for security on a desktop. That's cool, although keep in mind that if everything is talking to the same X server, then UID separation probably doesn't help much. If you're serious about this approach you should probably be using QubesOS.)

> You will need to let Sandstorm start as root Joke of today, thanks for the laugh.

by antocv 10y ago

> You will need to let Sandstorm start as root Joke of today, thanks for the laugh.

What do you run as root that isn't accessible to other users on your system, and why are you deploying Sandstorm on this machine? If it's a single-user machine, any process running at any privilege level can trivially get root by editing ~/.bashrc and aliasing the sudo command.

antocv 10y ago
Aliasing the sudo command? Are you serious? I dont even have sudo, let alone if I had it, I wouldnt use its dumb caching of credentials/session or "ask no password" "feature". Just because my system is single-user doesnt mean I run every process with that one user, in fact I run firefox as its own user, chrome has its own, mpd as its own user, nginx is its own user and so on. This is basic security practice. If you seriously think that it is so easy to get root just because you can run a process as a normal user - "by aliasing sudo command", then by all means run everything as root, whats the harm or big deal, right? Why do you even have a user which is non-root? Why cant sandstorm run like lighttpd or nginx - as their own user, requiring no capabilites, in fact even syscalls can be revoked from them with seccomp and they will still work fine. All they need is socket api, file system api ( open close create), and some others, no they dont need to load kernel modules, ptrace or open_file_handle_at and so on.
- kentonv 10y ago
  nginx usually needs to start as root, in order to bind low-numbered ports, but the worker processes run as non-root. Sandstorm works exactly the same way. nginx can run as completely non-root, if you are OK with high-numbered ports. Sandstorm can too, if you are OK with high-numbered ports and if unprivileged user namespaces are enabled. (It sounds like you actually use UID separation for security on a desktop. That's cool, although keep in mind that if everything is talking to the same X server, then UID separation probably doesn't help much. If you're serious about this approach you should probably be using QubesOS.)