6 ms·

Here's an example of how we've used this. RStudio Server[0] 1.3 and older hard-coded a number of paths, such as the path for storing temporary files: Instead o

Here's an example of how we've used this. RStudio Server[0] 1.3 and older hard-coded a number of paths, such as the path for storing temporary files: Instead of looking for the TMPDIR environment variable (as specified by POSIX[1]), R Studio Server would always use /tmp. That is extremely annoying, because we set TMPDIR to a path on fast local storage (SATA or NVMe SSDs) that the job scheduler cleans up at the end of the compute job. We do have a last-resort mechanism using pam_namespace[2], such that a user going to `/tmp` actually takes them to `/namespace/tmp/${username}`, but that is per-user, not per-job. If a user has two R Studio jobs, and those two jobs landed on the same host, there would be trouble. So, we used PRoot to wrap R Studio, with /tmp bind-mounted to a directory under TMPDIR. [0]: https://www.rstudio.com/products/rstudio/download-server/ https://www.rstudio.com/products/rstudio/download-server/ [1]: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1... [2]: https://linux.die.net/man/8/pam_namespace https://linux.die.net/man/8/pam_namespace

godelski 2y ago
For those that don’t know, you shouldn’t blindly let programs have access to tmp. They can get access to sockets and stuff. If you’re running with systemd there’s a private tmp option for this reason. It’s always best to sandbox programs when you can. Linux has been making this much easier but it’s still non trivial https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/
- westurner 2y ago
  From the systemd.exec man page: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe... : PrivateTmp=true #JoinsNamespaceOf= `unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing; `systemd-tmpfiles --help`: https://serverfault.com/questions/1010339/how-exactly-to-use-systemd-private-temporary-directory-feature/1142519#1142519 https://serverfault.com/questions/1010339/how-exactly-to-use...
  - mikepurvis 2y ago
    "`unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing" As an intermediate level user and sysadmin, this kind of thing underscores the good work systemd is doing making it easy to get sane and safe defaults for things otherwise fiddly enough that many normal people wouldn't bother.
    - westurner 2y ago
      And in a config file format so we don't have to add things like renice, respawn, chroot, and namespaces to a locally forked Sys-V unit script for just one distro. Thankful for systemd too.
- mjevans 2y ago
  Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?
  - godelski 2y ago
    Yeah that helps but it depends on the permission of the socket. You can make it harder to guess by changing control path. Here’s an article that talks about tmp[0]. But I mean if you wanted to be really secure you could use systemd nspawn and put each user into their own container[1] [0] https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ [1] https://kilabit.info/journal/2022/chrooting_ssh_user_into_systemd-nspawn/ https://kilabit.info/journal/2022/chrooting_ssh_user_into_sy...
paulyy_y 2y ago
Please don't use zero-based footnote citations, people will assume 1 is the first one (because that is the standard in like, all of literature) and muscle-memory click the first link when reading and have to then figure out that you are doing a non-standard thing.
- yjftsjthsd-h 2y ago
  I disagree; this is Hacker News, and the cultural background favors zero indexing.
- JonChesterfield 2y ago
  The natural numbers start from zero.
  - zamadatix 2y ago
    Funnily enough, that's exactly the debate (whether or not natural numbers start at 0 or 1). There is no universally right or wrong answer, is comp sci nerds just tend to like 0 :p.
    - Y_Y 2y ago
      Everyone knows N_0 == N\{0} == the natural numbers without zero. This resolves the ambiguity and was my go-to for zero-denier professors in undergrad. > But the natural numbers are for counting, you can't count to zero! Why don't you count the number of cool people who don't think zero is a natural number, loser? [0] also it works beautifully for pointer arithmetic
- malkia 2y ago
  This ain't Lua, Pascal, Basic or Real Life :)
- godelski 2y ago
  Looks like your new here, let me help out. Language is not defined by a dictionary or MLA guides or whatever. Language is defined by culture. Go ask any linguist if your in doubt. They’ll gladly talk your ear off about how language evolves and cliques form and how there’s in and out language which people can often identify others in their “tribe” by. Like respect for any culture, don’t come in and try to tell people what’s right or wrong. At least not until you can speak the language first. We use [0] because it’s how you index an array. More general to internet culture there’s also OP = original poster and we refer to comments above us like family relationships. Parent (you’re this comments parent), GP (the grandparent, one who used the [0] that triggered you), GGP, G..GP, there’s siblings/sister (everyone who replied to you) and so on. Generally people don’t say cousins, aunts, dust removed and so on but you might see it). RTFM = read the fucking Manual (RTFA for article). And many others. Welcome to the internet and Hacker News.

godelski 2y ago

For those that don’t know, you shouldn’t blindly let programs have access to tmp. They can get access to sockets and stuff. If you’re running with systemd there’s a private tmp option for this reason. It’s always best to sandbox programs when you can. Linux has been making this much easier but it’s still non trivial https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/

westurner 2y ago
From the systemd.exec man page: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe... : PrivateTmp=true #JoinsNamespaceOf= `unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing; `systemd-tmpfiles --help`: https://serverfault.com/questions/1010339/how-exactly-to-use-systemd-private-temporary-directory-feature/1142519#1142519 https://serverfault.com/questions/1010339/how-exactly-to-use...
- mikepurvis 2y ago
  "`unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing" As an intermediate level user and sysadmin, this kind of thing underscores the good work systemd is doing making it easy to get sane and safe defaults for things otherwise fiddly enough that many normal people wouldn't bother.
  - westurner 2y ago
    And in a config file format so we don't have to add things like renice, respawn, chroot, and namespaces to a locally forked Sys-V unit script for just one distro. Thankful for systemd too.
mjevans 2y ago
Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?
- godelski 2y ago
  Yeah that helps but it depends on the permission of the socket. You can make it harder to guess by changing control path. Here’s an article that talks about tmp[0]. But I mean if you wanted to be really secure you could use systemd nspawn and put each user into their own container[1] [0] https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ [1] https://kilabit.info/journal/2022/chrooting_ssh_user_into_systemd-nspawn/ https://kilabit.info/journal/2022/chrooting_ssh_user_into_sy...

paulyy_y 2y ago

Please don't use zero-based footnote citations, people will assume 1 is the first one (because that is the standard in like, all of literature) and muscle-memory click the first link when reading and have to then figure out that you are doing a non-standard thing.

yjftsjthsd-h 2y ago
I disagree; this is Hacker News, and the cultural background favors zero indexing.
JonChesterfield 2y ago
The natural numbers start from zero.
- zamadatix 2y ago
  Funnily enough, that's exactly the debate (whether or not natural numbers start at 0 or 1). There is no universally right or wrong answer, is comp sci nerds just tend to like 0 :p.
  - Y_Y 2y ago
    Everyone knows N_0 == N\{0} == the natural numbers without zero. This resolves the ambiguity and was my go-to for zero-denier professors in undergrad. > But the natural numbers are for counting, you can't count to zero! Why don't you count the number of cool people who don't think zero is a natural number, loser? [0] also it works beautifully for pointer arithmetic
malkia 2y ago
This ain't Lua, Pascal, Basic or Real Life :)
godelski 2y ago
Looks like your new here, let me help out. Language is not defined by a dictionary or MLA guides or whatever. Language is defined by culture. Go ask any linguist if your in doubt. They’ll gladly talk your ear off about how language evolves and cliques form and how there’s in and out language which people can often identify others in their “tribe” by. Like respect for any culture, don’t come in and try to tell people what’s right or wrong. At least not until you can speak the language first. We use [0] because it’s how you index an array. More general to internet culture there’s also OP = original poster and we refer to comments above us like family relationships. Parent (you’re this comments parent), GP (the grandparent, one who used the [0] that triggered you), GGP, G..GP, there’s siblings/sister (everyone who replied to you) and so on. Generally people don’t say cousins, aunts, dust removed and so on but you might see it). RTFM = read the fucking Manual (RTFA for article). And many others. Welcome to the internet and Hacker News.