3 ms·
I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc
by ashishbijlani 4y ago
I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages
1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes that installation will make and can also block arbitrary network communication during installation (uses an allow-list).
- remram 4y agostrace uses ptrace, which is not safe for security use because of race conditions. Linux Security Modules should be used. https://stackoverflow.com/a/4421762/711380 https://stackoverflow.com/a/4421762/711380
- ashishbijlani 4y agoThanks for highlighting this! While PTRACE introduces TOCTTOU vulnerabilities, Packj sandboxes fixes that by using read-only args for ptrace. You can find my PhD work [1] on this relevant. 1. https://lwn.net/Articles/803890/ https://lwn.net/Articles/803890/