5 ms·

I would call it maybe vageuly similar, but it is by no means a subset. It has some features in common and many that are completely nonsense in a posix context.

I would call it maybe vageuly similar, but it is by no means a subset. It has some features in common and many that are completely nonsense in a posix context. The most pressing problem for implementing plan9-like semantics in a POSIX system is the permission system. In particular, setuid as a mechanism for privilege escalation. This is a big part of why users can't make their own namespaces on linux without help/intervention from root-owned processes (like dockerd or systemd). Think about it: if you can make the file namespace any shape you want, and then run `sudo`, which is a setuid process that looks at /etc/sudo.conf to decide whether your escalation is allowed, how do you secure it? How do you even begin to do distributed permissions if everything's looking at /etc/passwd and /etc/group in the current process' namespace to decide who you are? POSIX is very much built on the idea of a canonical view of the filesystem, and plan9 is built on a vfs that may as well be sand.

lizknope 5y ago
Capabilities were supposed to split up the need to having a single root account that could do everything. I'm not sure how far it has gone. https://tbhaxor.com/understanding-linux-capabilities/ https://tbhaxor.com/understanding-linux-capabilities/ https://blog.container-solutions.com/linux-capabilities-in-practice https://blog.container-solutions.com/linux-capabilities-in-p...
- stormbrew 5y ago
  They're a good step but they're really a step in a different direction, even though capabilities are at the heart of how plan9 does permissions as well. Plan9 capabilities are more like kerberos tokens, so you get them from privileged services and then can use them to perform privileged actions. Linux capabilities don't really change any of the issues around namespace security because they don't inherently provide a way to elevate privileges without setuid.
DarylZero 5y ago
In modern Linux this is no problem. You can now give a process its own UID namespace. In the calling namespace its UID is non-zero, but in its own namespace it's root.
- ori_b 5y ago
  You understood the problem backwards. How do you give out actual, real, global root, without taking away the ability to do arbitrary namespaces?
  - DarylZero 5y ago
    I think you're right that I don't understand the problem. If you want to give actual real global root, I think you can do it by having a gifting process put the real global root process into the same process namespace as the giftee process.
    - ori_b 5y ago
      And how does that interact with binding files as non-root, including /etc/sudoers.conf? (plan 9 has no suid, so this is not a problem there)
      - DarylZero 5y ago
        I said more about that in the thread already.
  - sillysaurusx 5y ago
    I feel like plan9 nerds (of which I’m one) are missing the point. People are asking “what’s so special about plan9?” and the best response is some esoteric point about a thing people empirically don’t want to do? Who cares? There has to be a better answer than “Wow, I can make my computer that can’t run anything people want to run secure in a hypothetical hierarchical organization structure of permissions that can each have their own subtree sudo. I even call it treedo, ha-ha!” .. it just doesn’t resonate.
    - stormbrew 5y ago
      I dunno I think the positives are all actually pretty practical. Probably even more so today where heterogeneous computing is so much more common than it was in the 90s. I would frequently love to have the ability to just mount a bunch of cpus off a beefier machine onto my laptop and take advantage of that to speed up my builds. I can use DISTCC but holy hell is it a lot more complicated to set up. Or like, mounting a zip file as a directory, without needing a whole enormous systemd or gnome hairball along with fuse or gfs to make it happen as a regular user. Or hell, mount a usb stick even! These are literally things I wish were easier every day as a software developer. The vaguely plan9-shaped bits that have been added to linux over the years have brought me no closer to them.
deleted 5y ago
[deleted]

lizknope 5y ago

Capabilities were supposed to split up the need to having a single root account that could do everything. I'm not sure how far it has gone. https://tbhaxor.com/understanding-linux-capabilities/ https://tbhaxor.com/understanding-linux-capabilities/ https://blog.container-solutions.com/linux-capabilities-in-practice https://blog.container-solutions.com/linux-capabilities-in-p...

stormbrew 5y ago
They're a good step but they're really a step in a different direction, even though capabilities are at the heart of how plan9 does permissions as well. Plan9 capabilities are more like kerberos tokens, so you get them from privileged services and then can use them to perform privileged actions. Linux capabilities don't really change any of the issues around namespace security because they don't inherently provide a way to elevate privileges without setuid.

DarylZero 5y ago

In modern Linux this is no problem. You can now give a process its own UID namespace. In the calling namespace its UID is non-zero, but in its own namespace it's root.

ori_b 5y ago
You understood the problem backwards. How do you give out actual, real, global root, without taking away the ability to do arbitrary namespaces?
- DarylZero 5y ago
  I think you're right that I don't understand the problem. If you want to give actual real global root, I think you can do it by having a gifting process put the real global root process into the same process namespace as the giftee process.
  - ori_b 5y ago
    And how does that interact with binding files as non-root, including /etc/sudoers.conf? (plan 9 has no suid, so this is not a problem there)
    - DarylZero 5y ago
      I said more about that in the thread already.
- sillysaurusx 5y ago
  I feel like plan9 nerds (of which I’m one) are missing the point. People are asking “what’s so special about plan9?” and the best response is some esoteric point about a thing people empirically don’t want to do? Who cares? There has to be a better answer than “Wow, I can make my computer that can’t run anything people want to run secure in a hypothetical hierarchical organization structure of permissions that can each have their own subtree sudo. I even call it treedo, ha-ha!” .. it just doesn’t resonate.
  - stormbrew 5y ago
    I dunno I think the positives are all actually pretty practical. Probably even more so today where heterogeneous computing is so much more common than it was in the 90s. I would frequently love to have the ability to just mount a bunch of cpus off a beefier machine onto my laptop and take advantage of that to speed up my builds. I can use DISTCC but holy hell is it a lot more complicated to set up. Or like, mounting a zip file as a directory, without needing a whole enormous systemd or gnome hairball along with fuse or gfs to make it happen as a regular user. Or hell, mount a usb stick even! These are literally things I wish were easier every day as a software developer. The vaguely plan9-shaped bits that have been added to linux over the years have brought me no closer to them.

deleted 5y ago

[deleted]