4 ms·

Is there a minimum required kernel version? How does it compare to proot? We use proot in our build pipeline and it would be interesting to look into alternati

Is there a minimum required kernel version? How does it compare to proot? We use proot in our build pipeline and it would be interesting to look into alternatives.

jagger11 9y ago
Re kernel versions: Depending on when CLONE_NEWUSER and seccomp-bpf were added to the kernel for different CPU architectures. For x86-64 it was probably around 3.16, for some others it might be even 4.3 (e.g. ppc64). It might even work with earlier versions if you use --disable_clone_newuser and avoid using seccomp-bpf filters. Re 'proot'. I've never used it (it seems to be a configurator for the mount namespace), but nsjail seems much more advanced: cgroups support, seccomp-bpf via configuration language support, and a few more features (configs, net).
- therein 9y ago
  Thanks. I appreciate the response. I guess my only option until moving to a more recent kernel is `proot` as our build boxes are still in 2.6.32, but I am happy to have found out about `nsjail` for the future.
- audidude 9y ago
  What about older LTS systems that have CLONE_NEWUSER but only allow access to it from uid 0?
  - jagger11 9y ago
    You can run it as root, and specifiy users/groups to switch to before executing an app. Though, CLONE_NEWUSER was meant for exactly that - using namespaced without euid==0. Some systems like Debian have a sysctl flag: kernel.unprivileged_userns_clone which controls this behavior. Ultimately, it's up to you whether set it to "1", as CLONE_NEWUSER in the past opened many new attack vectors on the Linux kernel. However, I believe that currently the situation is much better, esp. after syzkaller and individual researchers reported and fixed many bugs in this area.
sitkack 9y ago
For reference, https://web.archive.org/web/20160305001149/http://proot.me/ https://web.archive.org/web/20160305001149/http://proot.me/

4 ms·

Is there a minimum required kernel version? How does it compare to proot? We use proot in our build pipeline and it would be interesting to look into alternati

by therein 9y ago

Is there a minimum required kernel version? How does it compare to proot? We use proot in our build pipeline and it would be interesting to look into alternatives.

jagger11 9y ago
Re kernel versions: Depending on when CLONE_NEWUSER and seccomp-bpf were added to the kernel for different CPU architectures. For x86-64 it was probably around 3.16, for some others it might be even 4.3 (e.g. ppc64). It might even work with earlier versions if you use --disable_clone_newuser and avoid using seccomp-bpf filters. Re 'proot'. I've never used it (it seems to be a configurator for the mount namespace), but nsjail seems much more advanced: cgroups support, seccomp-bpf via configuration language support, and a few more features (configs, net).
- therein 9y ago
  Thanks. I appreciate the response. I guess my only option until moving to a more recent kernel is `proot` as our build boxes are still in 2.6.32, but I am happy to have found out about `nsjail` for the future.
- audidude 9y ago
  What about older LTS systems that have CLONE_NEWUSER but only allow access to it from uid 0?
  - jagger11 9y ago
    You can run it as root, and specifiy users/groups to switch to before executing an app. Though, CLONE_NEWUSER was meant for exactly that - using namespaced without euid==0. Some systems like Debian have a sysctl flag: kernel.unprivileged_userns_clone which controls this behavior. Ultimately, it's up to you whether set it to "1", as CLONE_NEWUSER in the past opened many new attack vectors on the Linux kernel. However, I believe that currently the situation is much better, esp. after syzkaller and individual researchers reported and fixed many bugs in this area.
sitkack 9y ago
For reference, https://web.archive.org/web/20160305001149/http://proot.me/ https://web.archive.org/web/20160305001149/http://proot.me/