Suggestion: introduce a system call that eliminates access to all
real file systems for the current process. the only permissible
interaction would be stdin, stdout, and stderr.
this would make it very simple to write a sandboxed safe fcgi script.
the script could load all the dynamic libraries and data it wants, and
then call this no-more-filesystem-access feature (preferably allowable
without root privileges). thereafter, even if a hacker takes control
of the script, not much permanent damage can happen.
right now, it is much more complex to accomplish this---which is why
sandboxing cgi scripts is not used too often.
sincerely,
/iaw
----
Ivo Welch ([email protected])
On Mon, 21 May 2012 09:28:13 -0700 ivo welch wrote:
> Suggestion: introduce a system call that eliminates access to all
> real file systems for the current process. the only permissible
> interaction would be stdin, stdout, and stderr.
>
> this would make it very simple to write a sandboxed safe fcgi script.
> the script could load all the dynamic libraries and data it wants, and
> then call this no-more-filesystem-access feature (preferably allowable
> without root privileges). thereafter, even if a hacker takes control
> of the script, not much permanent damage can happen.
>
> right now, it is much more complex to accomplish this---which is why
> sandboxing cgi scripts is not used too often.
>
Check this out: http://en.wikipedia.org/wiki/Seccomp
--
Mihai Donțu
On Mon, 21 May 2012 09:28:13 -0700
ivo welch <[email protected]> wrote:
> Suggestion: introduce a system call that eliminates access to all
> real file systems for the current process. the only permissible
> interaction would be stdin, stdout, and stderr.
>
> this would make it very simple to write a sandboxed safe fcgi script.
No it wouldn't - because of things like ptrace.
Sandboxing done right is *hard*. SELinux and the other security setups
can do it. Containers can do interesting stuff in this space. Probably
the distros sometimes need to package the tools for it better.
Take a look at some of the cloud service code people have published.
Alan