From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Jann Horn <jannh@google.com>
Cc: Laurent Vivier <laurent@vivier.eu>,
kernel list <linux-kernel@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>,
containers@lists.linux-foundation.org, dima@arista.com,
Al Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel@vger.kernel.org,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: [PATCH v6 0/1] ns: introduce binfmt_misc namespace
Date: Thu, 01 Nov 2018 07:10:13 -0700 [thread overview]
Message-ID: <1541081413.2853.6.camel@HansenPartnership.com> (raw)
In-Reply-To: <CAG48ez3HnkRM6bUZMNjuTy5DgujgamEKhZOEWDfCjqW7fTJSzQ@mail.gmail.com>
On Thu, 2018-11-01 at 04:51 +0100, Jann Horn wrote:
> On Thu, Nov 1, 2018 at 3:59 AM James Bottomley
> <James.Bottomley@hansenpartnership.com> wrote:
> >
> > On Tue, 2018-10-16 at 11:52 +0200, Laurent Vivier wrote:
> > > Hi,
> > >
> > > Any comment on this last version?
> > >
> > > Any chance to be merged?
> >
> > I've got a use case for this: I went to one of the Graphene talks
> > in Edinburgh and it struck me that we seem to keep reinventing the
> > type of sandboxing that qemu-user already does. However if you
> > want to do an x86 on x86 sandbox, you can't currently use the
> > binfmt_misc mechanism because that has you running *every* binary
> > on the system emulated. Doing it per user namespace fixes this
> > problem and allows us to at least cut down on all the pointless
> > duplication.
>
> Waaaaaait. What? qemu-user does not do "sandboxing". qemu-user makes
> your code slower and *LESS* secure. As far as I know, qemu-user is
> only intended for purposes like development and testing.
Sandboxing is about protecting the cloud service provider (and other
tenants) from horizontal attack by reducing calls to the shared kernel.
I think it's pretty indisputable that full emulation is an effective
sandbox in that regard.
We can argue for about bugginess vs completeness, but technologically
qemu-user already has most of the system calls, which seems to be a
significant problem with other sandboxes. I also can't dispute it's
slower, but that's a tradeoff for people to make.
James
next prev parent reply other threads:[~2018-11-01 14:10 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-10 16:14 [PATCH v6 0/1] ns: introduce binfmt_misc namespace Laurent Vivier
2018-10-10 16:14 ` [PATCH v6 1/1] ns: add binfmt_misc to the user namespace Laurent Vivier
2018-10-16 10:13 ` Rasmus Villemoes
2018-10-16 10:53 ` Laurent Vivier
2018-10-16 16:22 ` Andrei Vagin
2018-10-24 17:15 ` Laurent Vivier
2018-10-30 8:51 ` Laurent Vivier
2018-11-06 19:40 ` Jann Horn
2018-10-16 9:52 ` [PATCH v6 0/1] ns: introduce binfmt_misc namespace Laurent Vivier
2018-11-01 2:59 ` James Bottomley
2018-11-01 3:51 ` Jann Horn
2018-11-01 12:28 ` Laurent Vivier
2018-11-01 14:16 ` Eric W. Biederman
2018-11-29 13:05 ` Laurent Vivier
2018-12-29 15:41 ` Laurent Vivier
2018-11-01 14:10 ` James Bottomley [this message]
2018-11-01 14:44 ` Jann Horn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1541081413.2853.6.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=containers@lists.linux-foundation.org \
--cc=dima@arista.com \
--cc=ebiederm@xmission.com \
--cc=jannh@google.com \
--cc=laurent@vivier.eu \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).