5 ms·

AWS an interesting example considering it's also a default search path for the SDK so anything using an AWS SDK is going to check for ~/.aws/config; does boxxy

AWS an interesting example considering it's also a default search path for the SDK so anything using an AWS SDK is going to check for ~/.aws/config; does boxxy apply the rules to anything run in a shell, or only if 'run by boxxy'?

notamy 4y ago
Only in the latter case; I didn't want to assume how people want things done, and implicitly magical tools break more often than not in my experience. You may also be able to tell I don't have a lot of AWS experience (:
- bheadmaster 4y ago
  Would be cool if there was a tool that could detect that configured path was attempted to be opened, and redirect the open() syscall to the real path... But that would most likely require kernel support. Boxxy seems good enough for userspace.
  - notamy 4y ago
    I actually attempted using ptrace to rewrite syscalls first! It was... horribly painful, and didn't work anywhere near as well as the bind-mount version.
    - oneplane 4y ago
      In the past I used something like inotab to use an inotify-based trigger to pipe data from SSH to a different system that didn't have any NAS or SAN support, it might also work to detect 'who' is touching any files that boxxy has previously seen rules for. Perhaps still too tricky to make it do magic things and break programs in the process, but it could be used to audit who's working with what paths and let the user print a report so they know what apps to boxx up and make them behave.
      - notamy 4y ago
        That is an excellent idea! Something like could definitely be worth adding. It's why there's a "remount rootfs as ro" flag; that way anything not specified in rules is ro and misbehaving programs will explode.
        oneplane 4y ago
        Love exploding apps. That's what they get for eating my filesystem.
    - yegle 4y ago
      Fun fact, one layer of App Engine's sandbox from a couple years ago was implemented using ptrace. It will redirect filesystem IO to in-memory files.
      - notamy 4y ago
        Interesting! That makes perfect sense, I just don't think I'm smart enough to use ptrace properly right now :P
        efreak 4y ago
        Try checking out proot?
        gary_0 4y ago
        Were you mostly going off the ptrace man page? I tried reading it to figure out ptrace and it made me feel not smart enough too.
        notamy 4y ago
        The man page + Google! There's very few good examples of it, and I've accepted that I'm just not familiar enough with that specific problem space.
    - lytigas 4y ago
      For a structured approach to ptrace/syscall rewriting, you could try FB's reverie. I worked on and used it during an internship a few years back; it's pretty amazing at what it does. https://github.com/facebookexperimental/reverie https://github.com/facebookexperimental/reverie
  - sjaak 4y ago
    Lo and behold http://ordiluc.net/fs/libetc/ http://ordiluc.net/fs/libetc/
- oneplane 4y ago
  I suppose that is indeed more trouble than it's worth. As for applications that might behave like AWS and their SDK; I think that if someone uses boxxy they would probably also remember to do the same thing for other stuff that uses aws under the hood, so overall a win either way!
- blueblob 4y ago
  If I were to try to do this without symlinks, maybe I'd try mount

notamy 4y ago

Only in the latter case; I didn't want to assume how people want things done, and implicitly magical tools break more often than not in my experience. You may also be able to tell I don't have a lot of AWS experience (:

bheadmaster 4y ago
Would be cool if there was a tool that could detect that configured path was attempted to be opened, and redirect the open() syscall to the real path... But that would most likely require kernel support. Boxxy seems good enough for userspace.
- notamy 4y ago
  I actually attempted using ptrace to rewrite syscalls first! It was... horribly painful, and didn't work anywhere near as well as the bind-mount version.
  - oneplane 4y ago
    In the past I used something like inotab to use an inotify-based trigger to pipe data from SSH to a different system that didn't have any NAS or SAN support, it might also work to detect 'who' is touching any files that boxxy has previously seen rules for. Perhaps still too tricky to make it do magic things and break programs in the process, but it could be used to audit who's working with what paths and let the user print a report so they know what apps to boxx up and make them behave.
    - notamy 4y ago
      That is an excellent idea! Something like could definitely be worth adding. It's why there's a "remount rootfs as ro" flag; that way anything not specified in rules is ro and misbehaving programs will explode.
      - oneplane 4y ago
        Love exploding apps. That's what they get for eating my filesystem.
  - yegle 4y ago
    Fun fact, one layer of App Engine's sandbox from a couple years ago was implemented using ptrace. It will redirect filesystem IO to in-memory files.
    - notamy 4y ago
      Interesting! That makes perfect sense, I just don't think I'm smart enough to use ptrace properly right now :P
      - efreak 4y ago
        Try checking out proot?
      - gary_0 4y ago
        Were you mostly going off the ptrace man page? I tried reading it to figure out ptrace and it made me feel not smart enough too.
        notamy 4y ago
        The man page + Google! There's very few good examples of it, and I've accepted that I'm just not familiar enough with that specific problem space.
  - lytigas 4y ago
    For a structured approach to ptrace/syscall rewriting, you could try FB's reverie. I worked on and used it during an internship a few years back; it's pretty amazing at what it does. https://github.com/facebookexperimental/reverie https://github.com/facebookexperimental/reverie
- sjaak 4y ago
  Lo and behold http://ordiluc.net/fs/libetc/ http://ordiluc.net/fs/libetc/
oneplane 4y ago
I suppose that is indeed more trouble than it's worth. As for applications that might behave like AWS and their SDK; I think that if someone uses boxxy they would probably also remember to do the same thing for other stuff that uses aws under the hood, so overall a win either way!
blueblob 4y ago
If I were to try to do this without symlinks, maybe I'd try mount