3 ms·

As an easy start, how about letting build scripts read /usr, read and write a temporary build directory, have some /tmp scratch space, and be allowed to write i

by amluto 2mo ago

As an easy start, how about letting build scripts read /usr, read and write a temporary build directory, have some /tmp scratch space, and be allowed to write its final output artifact. No network and otherwise isolated from the rest of the system. I would argue that, if a build script doesn’t work in the setting, then it doesn’t deserve to be installable by a default cargo command.

kibwen 2mo ago
Cargo is a cross-platform tool, so when it ships a sandboxing solution it will need to be a cross-platform solution, and because this is a security feature it needs to be bulletproof, so no half-measures like Docker. Something like a WASM runtime might fit the bill, though that will be much easier to get working for typical proc macros than for typical build scripts. If you only care about Unix, then you can do this yourself today by building code in your sandbox of choice.
- amluto 2mo ago
  > Cargo is a cross-platform tool, so when it ships a sandboxing solution it will need to be a cross-platform solution This seems like an excuse, not an actual objection. Linux can do seccomp or Landlock or gVisor or a combination. Seccomp and gVisor need no privileges. Windows has its internal weird mechanisms. Mac has sandbox-exec. Cargo could easily pick an appropriate sandbox for each major platform and ship it by default. > If you only care about Unix, then you can do this yourself today by building code in your sandbox of choice. This is ridiculous. The sandbox should not have network access, but cargo needs network access to download the package in the first place.
  - kibwen 2mo ago
    > Windows has its internal weird mechanisms. If you have a serious proposal, then I encourage someone to seriously propose it. Cargo is an understaffed open source project that, like the rest of the Rust project, relies largely on volunteers. However, gesturing to unspecified internal weird mechanisms does not strike me as a serious proposal worthy of consideration by anyone, so I'd suggest working on that first. > The sandbox should not have network access, but cargo needs network access to download the package in the first place. Naturally. Use `cargo fetch` to download a package locally without invoking any build step: https://doc.rust-lang.org/cargo/commands/cargo-fetch.html https://doc.rust-lang.org/cargo/commands/cargo-fetch.html

by amluto 2mo ago

kibwen 2mo ago

Cargo is a cross-platform tool, so when it ships a sandboxing solution it will need to be a cross-platform solution, and because this is a security feature it needs to be bulletproof, so no half-measures like Docker. Something like a WASM runtime might fit the bill, though that will be much easier to get working for typical proc macros than for typical build scripts. If you only care about Unix, then you can do this yourself today by building code in your sandbox of choice.

amluto 2mo ago
> Cargo is a cross-platform tool, so when it ships a sandboxing solution it will need to be a cross-platform solution This seems like an excuse, not an actual objection. Linux can do seccomp or Landlock or gVisor or a combination. Seccomp and gVisor need no privileges. Windows has its internal weird mechanisms. Mac has sandbox-exec. Cargo could easily pick an appropriate sandbox for each major platform and ship it by default. > If you only care about Unix, then you can do this yourself today by building code in your sandbox of choice. This is ridiculous. The sandbox should not have network access, but cargo needs network access to download the package in the first place.
- kibwen 2mo ago
  > Windows has its internal weird mechanisms. If you have a serious proposal, then I encourage someone to seriously propose it. Cargo is an understaffed open source project that, like the rest of the Rust project, relies largely on volunteers. However, gesturing to unspecified internal weird mechanisms does not strike me as a serious proposal worthy of consideration by anyone, so I'd suggest working on that first. > The sandbox should not have network access, but cargo needs network access to download the package in the first place. Naturally. Use `cargo fetch` to download a package locally without invoking any build step: https://doc.rust-lang.org/cargo/commands/cargo-fetch.html https://doc.rust-lang.org/cargo/commands/cargo-fetch.html