3 ms·

So currently it does compromise on security? Seems extremely misleading to claim any security if you are just currently ignoring the last years worth of major s

So currently it does compromise on security? Seems extremely misleading to claim any security if you are just currently ignoring the last years worth of major security issues.

Yetanfou 8y ago
From what I gather the thing is based on WASI which in early beta and for which many parts don't exist or don't work, networking and file access being a few of those [1]: Note that everything here is a prototype, and while a lot of stuff works, there are numerous missing features and some rough edges. One big thing that's not done yet is the actual mechanism to provide a directory as a pre-opened capability, to allow files to be opened. Some of the pieces are there (__wasilibc_register_preopened_fd) but they're not used yet. Networking support is also incomplete. In other words, this is a somewhat premature announcement when it comes to fulfilling those promises. [1] https://github.com/CraneStation/wasmtime/blob/master/docs/WASI-intro.md https://github.com/CraneStation/wasmtime/blob/master/docs/WA...
- sunfish 8y ago
  That sentence about pre-opened directory capabilities not being supported is actually outdated. They're supported now, so I've now updated the documentation. Thanks for pointing that out!
kllrnohj 8y ago
It also compromises on resource abuse: "lucet does not currently provide a framework for protecting against guests that consume excessive CPU time (e.g. via an infinite loop). These protections must be provided by the host environment." I'm not sure how you're supposed to handle that, either, given host environment usually does limiting at a process granularity but this doesn't use multiple processes.
- int_19h 8y ago
  Most OSes have a way to specify priority for a given thread.
  - kllrnohj 8y ago
    Priority yes, but that's barely useful. cgroups, rlimits, cpulimit, etc... are far more useful here, and are all per-process.
    - kentonv 8y ago
      You can use timer_create to arrange to deliver a signal after some amount of CPU time elapsed, then terminate the sandbox from the signal handler.

So currently it does compromise on security? Seems extremely misleading to claim any security if you are just currently ignoring the last years worth of major security issues.

Yetanfou 8y ago

From what I gather the thing is based on WASI which in early beta and for which many parts don't exist or don't work, networking and file access being a few of those [1]: Note that everything here is a prototype, and while a lot of stuff works, there are numerous missing features and some rough edges. One big thing that's not done yet is the actual mechanism to provide a directory as a pre-opened capability, to allow files to be opened. Some of the pieces are there (__wasilibc_register_preopened_fd) but they're not used yet. Networking support is also incomplete. In other words, this is a somewhat premature announcement when it comes to fulfilling those promises. [1] https://github.com/CraneStation/wasmtime/blob/master/docs/WASI-intro.md https://github.com/CraneStation/wasmtime/blob/master/docs/WA...

sunfish 8y ago
That sentence about pre-opened directory capabilities not being supported is actually outdated. They're supported now, so I've now updated the documentation. Thanks for pointing that out!

kllrnohj 8y ago

It also compromises on resource abuse: "lucet does not currently provide a framework for protecting against guests that consume excessive CPU time (e.g. via an infinite loop). These protections must be provided by the host environment." I'm not sure how you're supposed to handle that, either, given host environment usually does limiting at a process granularity but this doesn't use multiple processes.

int_19h 8y ago
Most OSes have a way to specify priority for a given thread.
- kllrnohj 8y ago
  Priority yes, but that's barely useful. cgroups, rlimits, cpulimit, etc... are far more useful here, and are all per-process.
  - kentonv 8y ago
    You can use timer_create to arrange to deliver a signal after some amount of CPU time elapsed, then terminate the sandbox from the signal handler.