5 ms·

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to ov

I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CWD and package manager caches and often won't even work since the malware usually expects some things to be available which are not in a permissionless sandbox. You can think of it as running a docker container, but without the requirement of having to have an image. It is the same thing flatpak is based on. As for server deployments, container hardening is your friend. Most supply chain attacks target build scripts so as long as you treat your CI/CD as an untrusted environment you should be good - there's quite a few resources on this so won't go into detail. Bonus points: use the same sandbox for AI. Stay safe out there.

vips7L 7mo ago
AFAIK maven doesn’t support post install logic like npm does. You have to explicitly optin with build plugins. It doesn’t let any arbitrary dependency run code on your machine.
- himata4113 7mo ago
  some post processors have chains to execution (ex: lombok)
  - vips7L 7mo ago
    You explicitly opt in by using a compiler plugin. Merely having it as a dependency, like in npm, doesn’t mean it can run code at build time.
johntash 7mo ago
Do you have a recommendation for something like bwrap but for macos? I've been trying to use bwrap more on my servers when I remember.
- himata4113 7mo ago
  unfortunately not, but there is work being done to support overlays properly I think?
micw 7mo ago
> SSH is forwarded via socket Maybe I misunderstood this point. But the ssh socket also gives access to your private keys, so I see no security gain in that point. Better to have a password protected key.
- himata4113 7mo ago
  It's so your private key is not stolen, but you're right passphrase protected keys win anyway. I use hardware keys so this isn't a problem for me to begin with.
captn3m0 7mo ago
This only works for post-install script attacks. When the package is compromised, just running require somewhere in your code will be enough, and that runs with node/java/python and no bwrap.
- himata4113 7mo ago
  node is also sandboxed within bwrap I have sandbox -p node if I have to give node access to other folders, I also have sandbox -m to define custom mountpoints if necessary and UNSAFE=1 as a last resort which just runs unsandboxed.
mixedbit 7mo ago
Check also https://github.com/wrr/drop https://github.com/wrr/drop which is a higher-level tool than bwrap. It allows you to make such isolated sandboxes with minimal configuration.
- stratos123 7mo ago
  This looks nice but I wouldn't trust a very fresh tool to do security correctly. As a higher-level alternative to bwrap, I sometimes use `flatpak run --filesystem=$PWD --command=bash org.freedesktop.Platform`. This is kind of an abuse of flatpaks but works just fine to make a sandbox. And unlike bwrap, it has sane defaults (no extra permissions, not even network, though it does allow xdg-desktop-portal).
  - OJFord 7mo ago
    Shame it's not a bit more mature, it does look like more the sort of thing I want. I use firejail a bit, but it's a bit awkward really. To be honest - and I can't really believe I'm saying it - what I really want is something more like Android permissions. (Except more granular file permissions, which Android doesn't do at all well.) Like: start with nothing, app is requesting x access, allow it this time; oh alright fine always allow it. Central place to manage it later. Etc.
ashishb 7mo ago
I wrote a Docker-based sandbox [1] for myself last year to control the blast radius of such malicious packages. https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox
- notachatbot123 7mo ago
  ^ Vibe-coded slop spam ^
  - ashishb 7mo ago
    What makes you think that? Your can see the commit history <10% of code is written by agents. Rest was all written by me. Unlike other criticisms of the project, this one feels personal as it is objectively incorrect.
    - notachatbot123 7mo ago
      Oops, sorry. Only had a look at recent commits.
- dfreire 7mo ago
  Very useful, thanks
kanbankaren 7mo ago
I think firejail is a much more flexible security sandbox than bwrap. It also comes with pre-defined profiles
- himata4113 7mo ago
  bwrap is as secure as you want it to be which I think is the primary advantage over anything else.
mxmlnkn 7mo ago
I like the idea of bubblewrap, but my pain point is that it is work to set it up correctly with bind mounts and forwarding necessary environment variables to make the program actually work usefully. Could you share your pip bwrap configuration? It sounds useful.
- himata4113 7mo ago
  can't really share a file here, feel free to email me

vips7L 7mo ago

AFAIK maven doesn’t support post install logic like npm does. You have to explicitly optin with build plugins. It doesn’t let any arbitrary dependency run code on your machine.

himata4113 7mo ago
some post processors have chains to execution (ex: lombok)
- vips7L 7mo ago
  You explicitly opt in by using a compiler plugin. Merely having it as a dependency, like in npm, doesn’t mean it can run code at build time.

johntash 7mo ago

Do you have a recommendation for something like bwrap but for macos? I've been trying to use bwrap more on my servers when I remember.

himata4113 7mo ago
unfortunately not, but there is work being done to support overlays properly I think?

micw 7mo ago

> SSH is forwarded via socket Maybe I misunderstood this point. But the ssh socket also gives access to your private keys, so I see no security gain in that point. Better to have a password protected key.

himata4113 7mo ago
It's so your private key is not stolen, but you're right passphrase protected keys win anyway. I use hardware keys so this isn't a problem for me to begin with.

captn3m0 7mo ago

This only works for post-install script attacks. When the package is compromised, just running require somewhere in your code will be enough, and that runs with node/java/python and no bwrap.

himata4113 7mo ago
node is also sandboxed within bwrap I have sandbox -p node if I have to give node access to other folders, I also have sandbox -m to define custom mountpoints if necessary and UNSAFE=1 as a last resort which just runs unsandboxed.

mixedbit 7mo ago

Check also https://github.com/wrr/drop https://github.com/wrr/drop which is a higher-level tool than bwrap. It allows you to make such isolated sandboxes with minimal configuration.

stratos123 7mo ago
This looks nice but I wouldn't trust a very fresh tool to do security correctly. As a higher-level alternative to bwrap, I sometimes use `flatpak run --filesystem=$PWD --command=bash org.freedesktop.Platform`. This is kind of an abuse of flatpaks but works just fine to make a sandbox. And unlike bwrap, it has sane defaults (no extra permissions, not even network, though it does allow xdg-desktop-portal).
- OJFord 7mo ago
  Shame it's not a bit more mature, it does look like more the sort of thing I want. I use firejail a bit, but it's a bit awkward really. To be honest - and I can't really believe I'm saying it - what I really want is something more like Android permissions. (Except more granular file permissions, which Android doesn't do at all well.) Like: start with nothing, app is requesting x access, allow it this time; oh alright fine always allow it. Central place to manage it later. Etc.

ashishb 7mo ago

I wrote a Docker-based sandbox [1] for myself last year to control the blast radius of such malicious packages. https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox

notachatbot123 7mo ago
^ Vibe-coded slop spam ^
- ashishb 7mo ago
  What makes you think that? Your can see the commit history <10% of code is written by agents. Rest was all written by me. Unlike other criticisms of the project, this one feels personal as it is objectively incorrect.
  - notachatbot123 7mo ago
    Oops, sorry. Only had a look at recent commits.
dfreire 7mo ago
Very useful, thanks

kanbankaren 7mo ago

I think firejail is a much more flexible security sandbox than bwrap. It also comes with pre-defined profiles

himata4113 7mo ago
bwrap is as secure as you want it to be which I think is the primary advantage over anything else.

mxmlnkn 7mo ago

I like the idea of bubblewrap, but my pain point is that it is work to set it up correctly with bind mounts and forwarding necessary environment variables to make the program actually work usefully. Could you share your pip bwrap configuration? It sounds useful.

himata4113 7mo ago
can't really share a file here, feel free to email me