4 ms·

hi everyone, i'm the author of CDE, so please feel free to ping me if you have questions, complaints, or bug reports. i'm in the midst of fixing a bunch of sil

hi everyone, i'm the author of CDE, so please feel free to ping me if you have questions, complaints, or bug reports. i'm in the midst of fixing a bunch of silly bugs now and improving the documentation.

rbanffy 16y ago
I find the dependency-capture mechanism very interesting. I would love to see it used to help generating dependency lists for package management systems too. I will probably have to build my first .rpm packages (I am yet to read the first docs) in the near future and CDE could be a lovely addition to my toolbox. Thanks for doing it.
Goladus 16y ago
This looks awesome. My biggest initial fear (not having used it yet), is that I would inadvertently package up something like my private SSH key.
- pgbovine 16y ago
  oh good point. the contents of the cde-package is simply a directory hierarchy, so you can feel free to use 'find' to skim thru it. also, i'm now adding a feature where you can tell cde to ignore certain directories (e.g., ~/.ssh/) so that it won't pick up those files.
  - bostonvaulter2 16y ago
    Maybe you could output a warning on files with perms like 600?
partition 16y ago
Something like this has been sorely needed. I'm wondering if it's possible to generalize this over different OSes, if the code itself is multi-platform, or there is some way to specify hints for it (or should there be). I also go to Stanford so would be easy to discuss this in depth if you want.
- pgbovine 16y ago
  please email me at the address listed on the website. looking forward to chatting more about this!
sandGorgon 16y ago
could you put up a doc or something explaining the difference to chroot jails ? because you mention: . CDE runs packaged programs in a sandbox similar to a chroot jail, but truly malicious applications can circumvent this sort of isolation attempt. Do you use similar techniques to chroot - essentially I am asking whether your code is basically chroot (in terms of its behavior AS WELL AS its internals) with some security features removed ?
- pgbovine 16y ago
  no, it's not using the same mechanism as a real chroot (since you need to be root user to create a chroot). cde uses strace to intercept all the system calls that a monitored child process makes, and re-writes all file access system calls to re-route their paths inside of cde-root/.

rbanffy 16y ago

I find the dependency-capture mechanism very interesting. I would love to see it used to help generating dependency lists for package management systems too. I will probably have to build my first .rpm packages (I am yet to read the first docs) in the near future and CDE could be a lovely addition to my toolbox. Thanks for doing it.

Goladus 16y ago

This looks awesome. My biggest initial fear (not having used it yet), is that I would inadvertently package up something like my private SSH key.

pgbovine 16y ago
oh good point. the contents of the cde-package is simply a directory hierarchy, so you can feel free to use 'find' to skim thru it. also, i'm now adding a feature where you can tell cde to ignore certain directories (e.g., ~/.ssh/) so that it won't pick up those files.
- bostonvaulter2 16y ago
  Maybe you could output a warning on files with perms like 600?

partition 16y ago

Something like this has been sorely needed. I'm wondering if it's possible to generalize this over different OSes, if the code itself is multi-platform, or there is some way to specify hints for it (or should there be). I also go to Stanford so would be easy to discuss this in depth if you want.

pgbovine 16y ago
please email me at the address listed on the website. looking forward to chatting more about this!

sandGorgon 16y ago

could you put up a doc or something explaining the difference to chroot jails ? because you mention: . CDE runs packaged programs in a sandbox similar to a chroot jail, but truly malicious applications can circumvent this sort of isolation attempt. Do you use similar techniques to chroot - essentially I am asking whether your code is basically chroot (in terms of its behavior AS WELL AS its internals) with some security features removed ?

pgbovine 16y ago
no, it's not using the same mechanism as a real chroot (since you need to be root user to create a chroot). cde uses strace to intercept all the system calls that a monitored child process makes, and re-writes all file access system calls to re-route their paths inside of cde-root/.