5 ms·

Still requires SUID. It makes no sense to have to increase privileges in order to be able to decrease privileges. Any process should be able to spawn a child pr

Still requires SUID. It makes no sense to have to increase privileges in order to be able to decrease privileges. Any process should be able to spawn a child process with strictly lesser privileges, including granular cpu, memory, network, and filesystem (including path and size restrictions) access. It's sad there isn't a simple, standard cross-platform API for doing this. I would be fine having to rewrite my apps to take advantage of some fancy capabilities-based security paradigm, but give me realistic APIs to do so. I'm currently experimenting with shipping apps as QEMU VMs, packaging QEMU and a minimal kernel with the app. It works surprisingly well, even on Windows with full x86 emulation. And with their newish WHPX API (basically kvm for Windows) the future might be really exciting. EDIT: Someone on the Firejail thread says bubblewrap can be compiled non-SUID and that's the common usage these days. I need to look into this more.

mwcampbell 5y ago
I've also been looking into shipping apps as VM images with a minimal kernel. Do you know if WHPX requires the user to have admin rights? On the host side, Windows and Mac ports of crosvm [1] could be useful. crosvm seems to have all the necessary virtio device types, but a greater focus on security than QEMU. [1]: https://google.github.io/crosvm/ https://google.github.io/crosvm/
- anderspitman 5y ago
  WHPX does not require admin in my testing, but it does require Windows Pro and several virtualization features to be enabled. It's not too bad but still not ideal. Currently I'm not banking on it though and focusing my testing assuming full emulation on older hardware. If you're interested in collaborating on this feel free to email me or open a thread over on https://forum.indiebits.io/ https://forum.indiebits.io/ EDIT: Also, Firecracker seems to have more steam behind it than crosvm. I really wish it ran on Windows. That said, QEMU does have a microvm mode[0] that looks very interesting. [0]: https://mergeboard.com/blog/2-qemu-microvm-docker/ https://mergeboard.com/blog/2-qemu-microvm-docker/
  - mwcampbell 5y ago
    To clarify, are you interested in shipping server or desktop applications as VMs?
    - anderspitman 5y ago
      Initially server apps. My overall goal is to lower the barrier of entry for self-hosting. The idea is you download an app like Nextcloud which would run inside an unprivileged QEMU VM, go through a quick OAuth flow to connect it to a tunneling service, and you have a secure, private, end-to-end encrypted private cloud without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc.
      - DiggyJohnson 5y ago
        hmmmmm > without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc. HMMMMMMMM!
        anderspitman 5y ago
        Honestly not sure what you mean.
kirbyfan64sos 5y ago
Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.
- usr1106 5y ago
  But unprivileged user namespaces are a risk on their own: Code that is supposed to be unprivileged suddenly runs as uid 0. Well, uid 0 "only" in a non-root namespace, but occasionally there have been vulnerabilities that missed the "only".
  - raesene9 5y ago
    Indeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)
SixDouble5321 5y ago
In response to the edit, I also read that and immediately came back here to check this thread.
the8472 5y ago
If you want to properly isolate the network (veth device, separate IP(4/6) address) you need at least a suid helper to attach that to a bridge, it can't be done with userNS alone. Userspace proxying are a kludge and don't provide all the tools that the kernel network stack does. That said, if you're using userNS then certainly the main executable should not be privileged, only some specialized helpers. And of course it should use caps instead of suid.

mwcampbell 5y ago

I've also been looking into shipping apps as VM images with a minimal kernel. Do you know if WHPX requires the user to have admin rights? On the host side, Windows and Mac ports of crosvm [1] could be useful. crosvm seems to have all the necessary virtio device types, but a greater focus on security than QEMU. [1]: https://google.github.io/crosvm/ https://google.github.io/crosvm/

anderspitman 5y ago
WHPX does not require admin in my testing, but it does require Windows Pro and several virtualization features to be enabled. It's not too bad but still not ideal. Currently I'm not banking on it though and focusing my testing assuming full emulation on older hardware. If you're interested in collaborating on this feel free to email me or open a thread over on https://forum.indiebits.io/ https://forum.indiebits.io/ EDIT: Also, Firecracker seems to have more steam behind it than crosvm. I really wish it ran on Windows. That said, QEMU does have a microvm mode[0] that looks very interesting. [0]: https://mergeboard.com/blog/2-qemu-microvm-docker/ https://mergeboard.com/blog/2-qemu-microvm-docker/
- mwcampbell 5y ago
  To clarify, are you interested in shipping server or desktop applications as VMs?
  - anderspitman 5y ago
    Initially server apps. My overall goal is to lower the barrier of entry for self-hosting. The idea is you download an app like Nextcloud which would run inside an unprivileged QEMU VM, go through a quick OAuth flow to connect it to a tunneling service, and you have a secure, private, end-to-end encrypted private cloud without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc.
    - DiggyJohnson 5y ago
      hmmmmm > without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc. HMMMMMMMM!
      - anderspitman 5y ago
        Honestly not sure what you mean.

kirbyfan64sos 5y ago

Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.

usr1106 5y ago
But unprivileged user namespaces are a risk on their own: Code that is supposed to be unprivileged suddenly runs as uid 0. Well, uid 0 "only" in a non-root namespace, but occasionally there have been vulnerabilities that missed the "only".
- raesene9 5y ago
  Indeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)

SixDouble5321 5y ago

In response to the edit, I also read that and immediately came back here to check this thread.

the8472 5y ago

If you want to properly isolate the network (veth device, separate IP(4/6) address) you need at least a suid helper to attach that to a bridge, it can't be done with userNS alone. Userspace proxying are a kludge and don't provide all the tools that the kernel network stack does. That said, if you're using userNS then certainly the main executable should not be privileged, only some specialized helpers. And of course it should use caps instead of suid.