[{"data":1,"prerenderedAt":267},["ShallowReactive",2],{"project-13211572":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":42,"post_text":44,"what":45,"said":65,"maker_in_thread":173,"shape":182,"grid":186,"attempts":227,"same_week":228,"maker_shows":212,"maker_hidden":259,"reader_version":260,"card":261},"13211572","FSSB","A filesystem sandbox for Linux","title","Show HN: FSSB – A filesystem sandbox for Linux","https:\u002F\u002Fgithub.com\u002Fadtac\u002Ffssb","github.com","adtac",1482157902,2016,43,20,817,2264,37,"shown","security_privacy","filesystem sandbox","cli",[21,24,25,26],"linux sandbox","ptrace","syscall interception","roasted",-0.552,{"positive":30,"neutral":31,"mixed":32,"critical":33},1,4,0,11,16,{"execution":36,"idea":37,"performance":39,"privacy":40,"docs":41},{"positive":32,"critical":31},{"positive":30,"critical":38},5,{"positive":32,"critical":30},{"positive":32,"critical":30},{"positive":32,"critical":32},[30,30,32,30,30,30,38,43,30,30,30,32,32,30,32,43,30,30,43,43],3,null,{"problem":46,"audience":44,"pricing":44,"motivation":44,"time_to_build":44,"stack":54,"openness":63,"stage":64,"team_size":63},{"value":47,"source":48,"evidence":49},"Run untrusted binaries and see what they would write to the filesystem without actually changing it","commenter",[50],{"id":51,"by":52,"text":53},"13212562","treve","It definitely doesn't make it safe, but it does allow you to run a binary and see what it would do to your filesystem, without actually doing it; which is pretty neat! chroot is…",[55],{"value":56,"source":57,"evidence":58},"C","inferred",[59],{"id":60,"by":61,"text":62},"13214204","__michaelg","``` $ cat > nope.c \u003C\u003CEOF > #include \u003Cstdio.h> > void main() { > write(creat(\"nope.nope\"), \"oh no\\n\", 6); > } > EOF $ make nope $ .\u002Ffssb -- .\u002Fnope fssb: child exited with 4 fssb:…","unknown","beta",{"praise":66,"objections":71,"requests":113,"questions":125,"alternatives":141},[67],{"value":68,"source":48,"evidence":69},"Neat idea for seeing what a binary would do to your filesystem",[70],{"id":51,"by":52,"text":53},[72,83,94,102],{"value":73,"source":48,"evidence":74},"Ptrace is slow and carries a large performance penalty",[75,79],{"id":76,"by":77,"text":78},"13212623","vbernat","Use of ptrace will incur a huge performance penalty. Why not just using a mount namespace and using an overlay filesystem?",{"id":80,"by":81,"text":82},"13214266","notacoward","I was wondering the same thing. I guess the ptrace approach is better than LD_PRELOAD, but it's still not as foolproof as a real filesystem. While this seems interesting as a…",{"value":84,"source":48,"evidence":85},"Blacklisting syscalls and paths is not secure; misses cases like creat and truncate",[86,89,93],{"id":87,"by":61,"text":88},"13214233","Lesson learned: blacklists are catastrophic for security purposes, because you will always miss something. Even if you didn't miss anything, the next kernel release will just add…",{"id":90,"by":91,"text":92},"13213105","tyingq","Interesting and cool, but I would be careful with it. It appears to intercept a fixed list of syscalls, so it may not be intercepting all of them that are relevant. I don't…",{"id":60,"by":61,"text":62},{"value":95,"source":48,"evidence":96},"Sandboxing filesystem access does not make untrusted binaries safe",[97,101],{"id":98,"by":99,"text":100},"13212434","gravypod","> Run arbitrary binaries that you don't trust safely (maybe you downloaded it from the internet). I don't think sandboxing is an appropriate solutionto this. Especially just…",{"id":51,"by":52,"text":53},{"value":103,"source":48,"evidence":104},"Ptrace-based approaches are notoriously insecure and easy to get around",[105,109],{"id":106,"by":107,"text":108},"13214330","Skunkleton","I do something like this using systemd containers based on btrfs snapshots of my current system[1]. I have also used docker to the same end. My past experience with Ptrace based…",{"id":110,"by":111,"text":112},"13213653","AstralStorm","This is essentially the same thing as either of: - Linux containers on a read only FS - weaker specialised version of seccomp - some similar preload intercept as in e.g. Gentoo…",[114,118],{"value":115,"source":48,"evidence":116},"Use a mount namespace with overlayfs instead of ptrace",[117],{"id":76,"by":77,"text":78},{"value":119,"source":48,"evidence":120},"Harden with a seccomp filter",[121],{"id":122,"by":123,"text":124},"13212754","Mic92","it could hardened it with seccomp filter.",[126,134],{"value":127,"source":48,"evidence":128},"How does this compare to chroot?",[129,130],{"id":98,"by":99,"text":100},{"id":131,"by":132,"text":133},"13214356","nisse72","Is this somehow better than chroot?",{"value":135,"source":48,"evidence":136},"What is it exactly, compared to capsicum or jails?",[137],{"id":138,"by":139,"text":140},"13212576","X86BSD","I can't even tell what this does. I just woke up but is this like capsicum on freebsd, https:\u002F\u002Fm.youtube.com\u002Fwatch?v=raNx9L4VH2k, or jails in the FS, or both? Clearly I need to…",[142,147,154,160,168],{"value":143,"source":48,"evidence":144},"Linux containers, systemd-nspawn, Docker",[145,146],{"id":106,"by":107,"text":108},{"id":110,"by":111,"text":112},{"value":148,"source":48,"evidence":149},"Firejail",[150],{"id":151,"by":152,"text":153},"13215119","chocolateboy","See also: Firejail * https:\u002F\u002Ffirejail.wordpress.com\u002F * https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=12239840",{"value":155,"source":48,"evidence":156},"mbox",[157],{"id":158,"by":123,"text":159},"13212736","There was a project which pursue a similar strategy: https:\u002F\u002Fgithub.com\u002Ftsgates\u002Fmbox",{"value":161,"source":48,"evidence":162},"Gentoo sandbox",[163,167],{"id":164,"by":165,"text":166},"13222462","e2kp","This looks like Gentoo's sandbox. Except Gentoo is a whitelist iirc",{"id":110,"by":111,"text":112},{"value":169,"source":48,"evidence":170},"chroot",[171,172],{"id":98,"by":99,"text":100},{"id":131,"by":132,"text":133},{"comments":174,"answered":32,"key":175},2,[176,179],{"id":177,"text":178},"13217719","Ugh, I forgot about `creat`. Should be an easy fix though :) Edit: done! FWIW, I agree with the other comment - blacklists might not be the best solution here.",{"id":180,"text":181},"13217746",">Linux containers on a read only FS Not really - the child program could realize that it's on a read-only FS. But with FSSB, this is actually hidden - the program thinks it's on…",{"commenters":183,"max_depth":43,"maker_replies":174,"first_comment_mins":184,"lifespan_hours":185},15,113,28,[187,189,191,193,195,196,197,199,201,202,203,206,209,211,213,215,218,220,223,225],[60,32,30,188,61,32],"project\u002Fcritical\u002Fexecution",[87,32,30,190,61,32],"project\u002Fcritical\u002Fidea",[177,32,32,192,11,30],"maker\u002Fneutral\u002Fexecution",[76,30,30,194,77,32],"project\u002Fcritical\u002Fperformance",[80,30,30,190,81,32],[98,174,30,190,99,32],[51,174,38,198,52,32],"project\u002Fpositive\u002Fidea",[122,174,43,200,123,32],"project\u002Fneutral\u002Fexecution",[106,43,30,188,107,32],[90,31,30,188,91,32],[204,38,30,188,205,32],"13218434","Rondom",[151,207,32,208,152,32],6,"other\u002Fneutral\u002Fnone",[158,210,32,208,123,32],7,[110,212,30,190,111,32],8,[180,212,32,214,11,30],"maker\u002Fneutral\u002Fidea",[164,216,43,217,165,32],9,"project\u002Fneutral\u002Fidea",[131,219,30,190,132,32],10,[221,219,30,222,165,32],"13222478","project\u002Fcritical\u002Fprivacy",[138,33,43,224,139,32],"project\u002Fneutral\u002Fdocs",[226,33,43,217,91,32],"13213148",[],[229,234,239,244,249,254],{"id":230,"name":231,"points":232,"category":233},"13194074","Oldster",475,"web_saas",{"id":235,"name":236,"points":237,"category":238},"13184143","Godb",205,"languages",{"id":240,"name":241,"points":242,"category":243},"13202610","Spark School",190,"learning_science",{"id":245,"name":246,"points":247,"category":248},"13211132","HoverPy",170,"ai",{"id":250,"name":251,"points":252,"category":253},"13230954","Google Blade",88,"productivity",{"id":255,"name":256,"points":257,"category":258},"13208352","Libtmux",86,"dev_tools",false,"v2",{"id":262,"name":5,"line":6,"ai":259,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":263,"top":18,"kw":264,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":265,"url":9,"mix":266,"praise":68,"objection":73,"sub":21},13211572,-0.55,[21,24,25,26],"11011153111001031133",[30,31,32,33],1793990952032]