Comments on tech & sp: ujail: use cases, FAQs, part 1 & proof of concept,...

@lamby: Thanks for the hint. This is actually sim...

2009-12-12T09:39:14.365+01:00

@lamby:

Thanks for the hint. This is actually similar to what I am working on right now.

@lindi

Without having had a look at the exact details plash seems to rely on software using the C-libraries functions for accessing syscalls instead of calling them directly. I have not yet tried it myself, but if my assumption is correct limitations could be worked around by doing a syscall directly. With a chroot in place and the "iptables tricks" (haven't looked at them) it is possible that plash provides a similar level of security though.
ujail is not about protecting the system from bugs in syscall implementations, but rather providing a secure sandboxing environment.

On your note about subterfugue: according to what looks like its official website it has been unmaintained since 2001, so it's probably not an option.

@3jAmY5a7:

Yes, this should be possible to do with ujail, once I get the code ready (which is likely to take some time).

3jAmY5a7: you can easily do that with subterfugue....

2009-12-11T00:35:14.000+01:00

3jAmY5a7: you can easily do that with subterfugue. It lets you write python code that can install handlers for syscalls.

Here is another use-case to consider: Sometimes I ...

2009-12-11T00:05:31.204+01:00

Here is another use-case to consider: Sometimes I use LD_PRELOAD tricks to change the behavior of a closed-source process, e.g. if the process creates and then deletes a file, I can replace the unlink operation so that the deleted file gets moved to a temporary directory instead. This only works if they use shared libraries, while replacing the unlink system call would instead let me easily do this to any binary.

@sp: Do you mean that a process could escape plash...

2009-12-10T10:25:01.379+01:00

@sp: Do you mean that a process could escape plash by making syscall directly? I thought the new UID/GID, chroot and iptables tricks were there to block file and network access. Of course you can try to exploit unknown linux bugs but can ujail really do much about those other than block some seldomly used syscalls completely?

Geordi is an IRC bot that uses a ptrace-based supe...

2009-12-09T13:18:44.976+01:00

Geordi is an IRC bot that uses a ptrace-based supervisor to compile execute arbitrary code. The code is written in literate Haskell so could provide a good example of what you want to do. Alternatively, the supervisor section can even be used outside of IRC - indeed, codepad.org runs on precisely this code.

@lindi: I totally agree with you that this approa...

2009-12-09T12:38:00.588+01:00

@lindi:

I totally agree with you that this approach is possibly faster than ujail. However, this can also be worked around by injecting code that invokes the syscalls directly. I also agree that this is hard to achieve from within python code, but not impossible, at least in theory.

Also, ujail should be a lot more flexible, as it applies to *any* binary, including the Python interpreter (and Perl, and machine-native code, and ...).

I will consider adding a comparison to plash the next time I update the FAQ.

Thanks for your input!

You might want add comparison to plash to your FAQ...

2009-12-09T11:57:17.286+01:00

You might want add comparison to plash to your FAQ. For example

python foo.py test1.txt test2.txt

in pola-shell will let foo.py only read the files test1.txt and test2.txt (There's a lot more syntax to specify what files can be written to).

Afaik plash works using a chroot and a modified glibc that can talk to the outside world using a unix socket. Via this unix socket it can prompt for my permissions and also ask the helper to open file descriptors for it, the file descriptors can then be passed via the unix socket so that they can be used in side the chroot.

Very cool and faster than tracing every syscall.