Hacker News Reader

Comment by pgbovine | Hacker News Reader

hi everyone, i'm the author of CDE, so please feel free to ping me if you have questions, complaints, or bug reports. i'm in the midst of fixing a bunch of silly bugs now and improving the documentation.

View on HN

I find the dependency-capture mechanism very interesting. I would love to see it used to help generating dependency lists for package management systems too.

I will probably have to build my first .rpm packages (I am yet to read the first docs) in the near future and CDE could be a lovely addition to my toolbox.

Thanks for doing it.

This looks awesome. My biggest initial fear (not having used it yet), is that I would inadvertently package up something like my private SSH key.

oh good point. the contents of the cde-package is simply a directory hierarchy, so you can feel free to use 'find' to skim thru it. also, i'm now adding a feature where you can tell cde to ignore certain directories (e.g., ~/.ssh/) so that it won't pick up those files.

Maybe you could output a warning on files with perms like 600?

Something like this has been sorely needed. I'm wondering if it's possible to generalize this over different OSes, if the code itself is multi-platform, or there is some way to specify hints for it (or should there be). I also go to Stanford so would be easy to discuss this in depth if you want.

please email me at the address listed on the website. looking forward to chatting more about this!

could you put up a doc or something explaining the difference to chroot jails ?

because you mention: . CDE runs packaged programs in a sandbox similar to a chroot jail, but truly malicious applications can circumvent this sort of isolation attempt.

Do you use similar techniques to chroot - essentially I am asking whether your code is basically chroot (in terms of its behavior AS WELL AS its internals) with some security features removed ?

no, it's not using the same mechanism as a real chroot (since you need to be root user to create a chroot). cde uses strace to intercept all the system calls that a monitored child process makes, and re-writes all file access system calls to re-route their paths inside of cde-root/.

Reply on news.ycombinator.com