FSSB
Security and privacy
filesystem sandbox
SHOW HN2016
How HN took it
1 positive, 4 neutral or asking, 0 mixed, 11 critical, out of 16 comments about the project. Thread score -0.55.
Idea: 1 for, 5 againstExecution: 0 for, 4 againstPerformance: 0 for, 1 againstPrivacy: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Neat idea for seeing what a binary would do to your filesystem
From 1 comment
It definitely doesn't make it safe, but it does allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat! chroot is…
treve on HN
Objections
Ptrace is slow and carries a large performance penalty
From 2 comments
Use of ptrace will incur a huge performance penalty. Why not just using a mount namespace and using an overlay filesystem?
vbernat on HNI was wondering the same thing. I guess the ptrace approach is better than LD_PRELOAD, but it's still not as foolproof as a real filesystem. While this seems interesting as a…
notacoward on HN
Blacklisting syscalls and paths is not secure; misses cases like creat and truncate
From 3 comments
Lesson learned: blacklists are catastrophic for security purposes, because you will always miss something. Even if you didn't miss anything, the next kernel release will just add…
__michaelg on HNInteresting and cool, but I would be careful with it. It appears to intercept a fixed list of syscalls, so it may not be intercepting all of them that are relevant. I don't…
tyingq on HN``` $ cat > nope.c <<EOF > #include <stdio.h> > void main() { > write(creat("nope.nope"), "oh no\n", 6); > } > EOF $ make nope $ ./fssb -- ./nope fssb: child exited with 4 fssb:…
__michaelg on HN
Sandboxing filesystem access does not make untrusted binaries safe
From 2 comments
> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just…
gravypod on HNIt definitely doesn't make it safe, but it does allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat! chroot is…
treve on HN
Ptrace-based approaches are notoriously insecure and easy to get around
From 2 comments
I do something like this using systemd containers based on btrfs snapshots of my current system[1]. I have also used docker to the same end. My past experience with Ptrace based…
Skunkleton on HNThis is essentially the same thing as either of: - Linux containers on a read only FS - weaker specialised version of seccomp - some similar preload intercept as in e.g. Gentoo…
AstralStorm on HN
Requests
Use a mount namespace with overlayfs instead of ptrace
From 1 comment
Use of ptrace will incur a huge performance penalty. Why not just using a mount namespace and using an overlay filesystem?
vbernat on HN
Harden with a seccomp filter
From 1 comment
it could hardened it with seccomp filter.
Mic92 on HN
Questions
How does this compare to chroot?
From 2 comments
> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just…
gravypod on HNIs this somehow better than chroot?
nisse72 on HN
What is it exactly, compared to capsicum or jails?
From 1 comment
I can't even tell what this does. I just woke up but is this like capsicum on freebsd, https://m.youtube.com/watch?v=raNx9L4VH2k, or jails in the FS, or both? Clearly I need to…
X86BSD on HN
Alternatives named
Linux containers, systemd-nspawn, Docker
From 2 comments
I do something like this using systemd containers based on btrfs snapshots of my current system[1]. I have also used docker to the same end. My past experience with Ptrace based…
Skunkleton on HNThis is essentially the same thing as either of: - Linux containers on a read only FS - weaker specialised version of seccomp - some similar preload intercept as in e.g. Gentoo…
AstralStorm on HN
Firejail
From 1 comment
See also: Firejail * https://firejail.wordpress.com/ * https://news.ycombinator.com/item?id=12239840
chocolateboy on HN
mbox
From 1 comment
There was a project which pursue a similar strategy: https://github.com/tsgates/mbox
Mic92 on HN
Gentoo sandbox
From 2 comments
This looks like Gentoo's sandbox. Except Gentoo is a whitelist iirc
e2kp on HNThis is essentially the same thing as either of: - Linux containers on a read only FS - weaker specialised version of seccomp - some similar preload intercept as in e.g. Gentoo…
AstralStorm on HN
chroot
From 2 comments
> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just…
gravypod on HNIs this somehow better than chroot?
nisse72 on HN