4 ms·

This is great. I'm building something similar, an effects system for rust, and it looks quite a bit like this. The difference is that my effects system compiles

This is great. I'm building something similar, an effects system for rust, and it looks quite a bit like this. The difference is that my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time. I have a notion of purity as well :P I think the applications of this sort of thing are pretty limitless. Maybe rust has `unsafe` but with further verification extensions to the language we can really push confidence in a working, safe product.

jahewson 4y ago
> compiles to a seccomp + apparmor profile That’s a really nice demonstrable and practical impact of using effects!
fire 4y ago
> my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time. is this open or proprietary? I'd love a link to a repo
- insanitybit 4y ago
  I'll see if I can open source it this weekend. I'm not trying to be the "like and subscribe for updates" but if you want to see it when it's open source I'd suggest following me on Twitter (or Github? Does Github have a follow thing?) cause I won't remember to reply on HN. Here's a little snippet: #[effect::declare( args=(inner_tmp as I) returns=("/tmp/" + I) )] fn tmp_dir(inner_tmp: Path) -> Path { Path::from("tmp/").join(inner_tmp) } So it can reason about that Path's constraints. When that Path gets used by, say, "File::create(path)", it gets turned into a rule and added to an apparmor policy. Apparmor doesn't support a "hey I'm a process, please sandbox me" so I have to write a privileged daemon that manages that bit. I also have a way to apply effects to functions you don't own, mutating functions, functions that branch, etc. None of that is implemented yet, just designed.
  - fire 4y ago
    what's your twitter/gh? Could you add them to your hn profile?
    - littlestymaar 4y ago
      Can't be certain, but given the content I'm pretty sure that it's these ones: - Github : https://github.com/insanitybit https://github.com/insanitybit - Twitter: https://twitter.com/InsanityBit https://twitter.com/InsanityBit
      - insanitybit 4y ago
        Thanks, yes. I'll add those to my profile.
        fire 4y ago
        Nice, followed you on both
littlestymaar 4y ago
> The difference is that my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time. That's awesome! I started working to sandbox my Rust program using seccomp-BPF, and I was quickly frustrated about having to run my program with strace to find out what syscalls I should allow for my program, when it sounded like this information should be available at compile time!
- insanitybit 4y ago
  I've wanted to do this for years and I've tried doing it a few times in some weird ways. I'm finally doing it in a hacky but more straightforward way and it's going well.
Grimburger 4y ago
Any public repo yet? This sounds great.
Self-Perfection 4y ago
Can it compile to systemd service sandboxing directives? Like described here https://www.ctrl.blog/entry/systemd-service-hardening.html https://www.ctrl.blog/entry/systemd-service-hardening.html

jahewson 4y ago

> compiles to a seccomp + apparmor profile That’s a really nice demonstrable and practical impact of using effects!

fire 4y ago

> my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time. is this open or proprietary? I'd love a link to a repo

insanitybit 4y ago
I'll see if I can open source it this weekend. I'm not trying to be the "like and subscribe for updates" but if you want to see it when it's open source I'd suggest following me on Twitter (or Github? Does Github have a follow thing?) cause I won't remember to reply on HN. Here's a little snippet: #[effect::declare( args=(inner_tmp as I) returns=("/tmp/" + I) )] fn tmp_dir(inner_tmp: Path) -> Path { Path::from("tmp/").join(inner_tmp) } So it can reason about that Path's constraints. When that Path gets used by, say, "File::create(path)", it gets turned into a rule and added to an apparmor policy. Apparmor doesn't support a "hey I'm a process, please sandbox me" so I have to write a privileged daemon that manages that bit. I also have a way to apply effects to functions you don't own, mutating functions, functions that branch, etc. None of that is implemented yet, just designed.
- fire 4y ago
  what's your twitter/gh? Could you add them to your hn profile?
  - littlestymaar 4y ago
    Can't be certain, but given the content I'm pretty sure that it's these ones: - Github : https://github.com/insanitybit https://github.com/insanitybit - Twitter: https://twitter.com/InsanityBit https://twitter.com/InsanityBit
    - insanitybit 4y ago
      Thanks, yes. I'll add those to my profile.
      - fire 4y ago
        Nice, followed you on both

littlestymaar 4y ago

> The difference is that my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time. That's awesome! I started working to sandbox my Rust program using seccomp-BPF, and I was quickly frustrated about having to run my program with strace to find out what syscalls I should allow for my program, when it sounded like this information should be available at compile time!

insanitybit 4y ago
I've wanted to do this for years and I've tried doing it a few times in some weird ways. I'm finally doing it in a hacky but more straightforward way and it's going well.

Grimburger 4y ago

Any public repo yet? This sounds great.

Self-Perfection 4y ago

Can it compile to systemd service sandboxing directives? Like described here https://www.ctrl.blog/entry/systemd-service-hardening.html https://www.ctrl.blog/entry/systemd-service-hardening.html