Hacker News Reader

Comment by apitman | Hacker News Reader

Still requires SUID. It makes no sense to have to increase privileges in order to be able to decrease privileges. Any process should be able to spawn a child process with strictly lesser privileges, including granular cpu, memory, network, and filesystem (including path and size restrictions) access. It's sad there isn't a simple, standard cross-platform API for doing this.

I would be fine having to rewrite my apps to take advantage of some fancy capabilities-based security paradigm, but give me realistic APIs to do so.

I'm currently experimenting with shipping apps as QEMU VMs, packaging QEMU and a minimal kernel with the app. It works surprisingly well, even on Windows with full x86 emulation. And with their newish WHPX API (basically kvm for Windows) the future might be really exciting.

EDIT: Someone on the Firejail thread says bubblewrap can be compiled non-SUID and that's the common usage these days. I need to look into this more.

View on HN

If you want to properly isolate the network (veth device, separate IP(4/6) address) you need at least a suid helper to attach that to a bridge, it can't be done with userNS alone. Userspace proxying are a kludge and don't provide all the tools that the kernel network stack does.

That said, if you're using userNS then certainly the main executable should not be privileged, only some specialized helpers. And of course it should use caps instead of suid.

Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.

But unprivileged user namespaces are a risk on their own: Code that is supposed to be unprivileged suddenly runs as uid 0. Well, uid 0 "only" in a non-root namespace, but occasionally there have been vulnerabilities that missed the "only".

Indeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)

I've also been looking into shipping apps as VM images with a minimal kernel. Do you know if WHPX requires the user to have admin rights? On the host side, Windows and Mac ports of crosvm [1] could be useful. crosvm seems to have all the necessary virtio device types, but a greater focus on security than QEMU.

[1]: https://google.github.io/crosvm/

WHPX does not require admin in my testing, but it does require Windows Pro and several virtualization features to be enabled. It's not too bad but still not ideal.

Currently I'm not banking on it though and focusing my testing assuming full emulation on older hardware.

If you're interested in collaborating on this feel free to email me or open a thread over on

https://forum.indiebits.io/

EDIT: Also, Firecracker seems to have more steam behind it than crosvm. I really wish it ran on Windows. That said, QEMU does have a microvm mode[0] that looks very interesting.

[0]: https://mergeboard.com/blog/2-qemu-microvm-docker/

To clarify, are you interested in shipping server or desktop applications as VMs?

Initially server apps. My overall goal is to lower the barrier of entry for self-hosting. The idea is you download an app like Nextcloud which would run inside an unprivileged QEMU VM, go through a quick OAuth flow to connect it to a tunneling service, and you have a secure, private, end-to-end encrypted private cloud without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc.

hmmmmm > without ever having to understand TLS, HTTPS, NAT, IP addresses, ports, CLI, etc. HMMMMMMMM!

Honestly not sure what you mean.

In response to the edit, I also read that and immediately came back here to check this thread.

Reply on news.ycombinator.com