<div dir="ltr">I fully share this point of view: having opam in control of the sandbox provides much finer grain. So, from a functional standpoint, I would not hesitate.<div><br></div><div>What makes me hesitate is that we would need to change the opam code for this, and take into account all possible different mechanisms according to os/platform. This is pretty well doable, if we set up a proper plugin mechanism, and we could share code with a plugin-based depext support, but it requires more effort :-)</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-02-25 11:54 GMT+01:00 Anil Madhavapeddy <span dir="ltr"><<a href="mailto:anil@recoil.org" target="_blank">anil@recoil.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm also not sure how viable activating it for day-to-day testing except<br>
by advanced users is. However, we can at least get the infrastructure in<br>
place for CI, which is necessary before we need to decide that.<br>
<br>
I forgot one point in my previous mail: why this needs to be in OPAM instead<br>
of just an external `sandbox` binary. We don't actually want to sandbox<br>
OPAM itself (which we trust!), but rather the packages it invokes. In my<br>
OpenBSD sandbox, I am constraining OPAM and all its future subshells.<br>
Instead, I would prefer to have OPAM invoke an external sandbox only when<br>
it is doing a build, with sufficient arguments to let it know which dirs<br>
are ok to write into.<br>
<br>
This would let a package only write into the specific subdirectory relevant<br>
to the current switch. This actually bites me quite often with pinning,<br>
since a stale OASIS setup.data can cause an installation to write into the<br>
wrong switch if a full clean is not done ahead of time. It also lets us<br>
sandbox network access of builds independently of OPAM, which is needed to<br>
"unplug" an OPAM package build.<br>
<br>
cheers,<br>
Anil<br>
<div class="HOEnZb"><div class="h5"><br>
> On 25 Feb 2015, at 10:48, Roberto Di Cosmo <<a href="mailto:roberto@dicosmo.org">roberto@dicosmo.org</a>> wrote:<br>
><br>
> Many thanks Anil, that's precious information:<br>
> this is clearly another very OS-specific feature!<br>
><br>
> The question is whether we want to add these policies and tools<br>
><br>
> - outside opam (pro: no changes to opam, cons: opam has no control)<br>
> - or make opam aware of them (pro: opam gets control, cons: various changes to opam)<br>
><br>
> For CI testing, the "outside" approach seems to be quite sufficient.<br>
><br>
> For day to day use, though, I am not sure...<br>
><br>
> On Tue, Feb 24, 2015 at 04:22:31PM +0000, Anil Madhavapeddy wrote:<br>
>> Hi Roberto, Simon,<br>
>><br>
>> Sandboxing mechanisms have come along quite a bit in the last few years.<br>
>> It's important to separate the two threat models that we want, since their<br>
>> use can be quite intrusive if made mandatory. I see two modes of operation:<br>
>><br>
>> - A mandatory sandbox in CI testing, where we use it to check that the<br>
>> package isn't violating obvious policies such as network downloads<br>
>> from within the package, or writing outside of ~/.opam or /tmp.<br>
>><br>
>> - Optional sandbox for day-to-day use by end users. This will catch<br>
>> even malicious behaviours, but imposes a rather heavy support burden.<br>
>><br>
>> In terms of how to sandbox applications, I know of:<br>
>><br>
>> - OpenBSD: I use the built-in systrace system call permissions subsystem<br>
>> already with OPAM. I've uploaded my local policy to GitHub at:<br>
>> <a href="https://gist.github.com/avsm/8293aa52c6cee772a9cb" target="_blank">https://gist.github.com/avsm/8293aa52c6cee772a9cb</a><br>
>> This policy is used by "systrace opam install foo" and pulls up an<br>
>> interactive dialog if an application attempts to write outside of<br>
>> either ~/.opam or /tmp.<br>
>> See: <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace" target="_blank">http://www.openbsd.org/cgi-bin/man.cgi?query=systrace</a><br>
>> or: <a href="http://www.citi.umich.edu/u/provos/systrace/" target="_blank">http://www.citi.umich.edu/u/provos/systrace/</a><br>
>> paper: <a href="http://www.citi.umich.edu/u/provos/papers/systrace.pdf" target="_blank">http://www.citi.umich.edu/u/provos/papers/systrace.pdf</a><br>
>><br>
>> - FreeBSD: the latest versions have the Capsicum capability system<br>
>> integrated, and the Casper system daemon that grants common operations<br>
>> is also being worked on upstream (e.g. for name resolution)<br>
>> See: <a href="https://www.cl.cam.ac.uk/research/security/capsicum/" target="_blank">https://www.cl.cam.ac.uk/research/security/capsicum/</a><br>
>><br>
>> - Linux: As always with Linux, there are a myriad of possible solutions.<br>
>> I'd discourage the use of LD_PRELOAD based solutions since they don't<br>
>> work in several situations reliably (most obviously with static binaries).<br>
>> The fakeroot-ng project uses ptrace instead, which is more reliable.<br>
>><br>
>> However, the primary thing we want is to only let the package only<br>
>> write into ~/.opam, and so the mount namespace feature (see CLONE_NEWNS)<br>
>> may be sufficient for our needs -- a lightweight filesystem container,<br>
>> in effect. David Sheets has done some investigation into this for<br>
>> another project we're working on.<br>
>><br>
>> - Windows: various, Sandboxie is one solution, but the underlying<br>
>> mechanism is the Windows Integrity Mechanism that was introduced in<br>
>> Vista: <a href="https://msdn.microsoft.com/en-us/library/bb625964.aspx" target="_blank">https://msdn.microsoft.com/en-us/library/bb625964.aspx</a><br>
>> This lets applications drop privileges, and is used by the Chrome<br>
>> sandbox (in general, following what Chrome does for sandboxing is a<br>
>> good idea, since their needs are a superset of ours).<br>
>><br>
>> - MacOS X: The App Sandbox requires code signing, but does almost<br>
>> exactly what we need: it gives each app/user a unique directory<br>
>> into which they can write files. All we should need to do is to<br>
>> set OPAMROOT to that directory, and everything should just work.<br>
>> In practise, this requires some investigation into how the App<br>
>> signing infrastructure works, since I've only seen it done for<br>
>> bundles and not for CLI tools.<br>
>><br>
>> This is a quick off-the-top-of-my-head survey, but I think it's viable<br>
>> and useful for us to build an `opam sandbox` in the same style as<br>
>> `opam depext` that attempts to invoke a relevant sandboxing mechanism<br>
>> depending on the OS. In the longer term, this will really serve us<br>
>> well as the package database grows.<br>
>><br>
>> I'm less sure about the viability of recording installed files<br>
>> strictly -- I view thatas an advisory rather than enforcement-based<br>
>> mechanism. The reason I like the "make ~/.opam a git store" is that<br>
>> its possible for applications to write directly into the store as they<br>
>> do right now, but still let us track changes precisely. In fact, if<br>
>> we forbid subshells from writing into `~/.opam/.git`, this would be<br>
>> a production grade solution that also offers instant-rollback in case<br>
>> of compilation errors (no more waiting for a full recompilation of<br>
>> the original dependencies!).<br>
>><br>
>> cheers,<br>
>> Anil<br>
>><br>
>>> On 21 Feb 2015, at 09:16, Roberto Di Cosmo <<a href="mailto:roberto@dicosmo.org">roberto@dicosmo.org</a>> wrote:<br>
>>><br>
>>> Anil, Simon, can you provide more details on the sandboxing mechanisms you know of?<br>
>>><br>
>>> We looked into all this for Mancoosi years ago; the most complete tool<br>
>>> out there was installwatch (now checkinstall) that hijacks filesystem modifying<br>
>>> commands using the standard LD_PRELOAD trick and a wrapper for system calls.<br>
>>> Checkinstall does not alter user priviledges, though, so one sometimes needed<br>
>>> a combination of fakeroot (that only alter user priviledges) with it.<br>
>>><br>
>>> The best approach I know of was described in a Master thesis from ... Cambridge<br>
>>> :-) It was under the supervision of Peter Sewell, and used the ptrace mechanism<br>
>>> instead of the LD_PRELOAD trick, because LD_PRELOAD is blind to statically<br>
>>> compiled binaries that have system calls hardcoded, while ptrace gets them all.<br>
>>><br>
>>> The dissertation is still available today here <a href="http://robot101.net/files/diss.ps.gz" target="_blank">http://robot101.net/files/diss.ps.gz</a><br>
>>> and contains a very nice discussion of the issues related to monitoring and<br>
>>> rolling back file system changes performed by a command in the Linux system.<br>
>>> The source code is also available here <a href="http://robot101.net/files/trace.tar.gz" target="_blank">http://robot101.net/files/trace.tar.gz</a><br>
>>> and one can get in touch with Robert Mcqueen that will be delighted to see his<br>
>>> work being used.<br>
>>><br>
>>> Since all this is almost 10 years old, I suppose many exciting new ideas, tools<br>
>>> and approaches surfaced in the meantime, and I'd really like to know more.<br>
>>><br>
>>> Cheers<br>
>>><br>
>>> --<br>
>>> Roberto<br>
>>><br>
>>> On Sat, Feb 21, 2015 at 09:37:07AM +0100, Simon Cruanes wrote:<br>
>>>> Sandboxing the build would also be a big security improvement. I think cabal<br>
>>>> now does it, and signing packages doesn't protect against malicious or buggy<br>
>>>> packages (see: bumblebee's uninstall target). That also goes hand in hand with<br>
>>>> file tracking. I don't know how difficult it is, though.<br>
>>>><br>
>>>> Cheers!<br>
>>>><br>
>>>> Le 21 février 2015 05:01:56 UTC+01:00, Louis Gesbert<br>
>>>> <<a href="mailto:louis.gesbert@ocamlpro.com">louis.gesbert@ocamlpro.com</a>> a écrit :<br>
>>>><br>
>>>> With 1.2.1 almost out of the door, time has come to review the roadmap discussed back in December and choose where we'll be going for 1.3. Original mail attached for reference.<br>
>>>><br>
>>>><br>
>>>> The topic that is burning hot at the moment is, specially after the Debian Haskell build host has been compromised, security: we have no signing at all at the moment, and we need to improve on this before it becomes a problem. TUF [1] has devised a sane amount of rules for repository management and signing that should make it easier to get it right in OPAM. Hannes has mentionned writing an OCaml implementation for TUF, which could get very helpful.<br>
>>>><br>
>>>><br>
>>>> Also of importance is Windows support. It should at least be straighforward and documented to get a basic Cygwin setup working. That goes with adding automated tests (appveyor can now be added in Github alongside Travis). Related is cleaning up external command usage (even if not really justified by a Windows<br>
>>>> port only, as David Allsopp pointed out) -- replacing curl calls by cohttp, use ocaml-fileutils...<br>
>>>><br>
>>>><br>
>>>> These are the other main features, that'll probably take more time if we are to focus eg. on security:<br>
>>>><br>
>>>> * a plugin mechanism with plugins for example for OCaml (for better agnosticity), external dependency handling [2], documentation generation...<br>
>>>><br>
>>>> * a 'provides:' field in OPAM files [3]. This is a loose requirement if we want to switch the repository to have OCaml itself in a package (which is already possible, but the system compiler may yet be an issue).<br>
>>>><br>
>>>> * More flexible switch handling (multi-switch packages, per-switch remotes, layered switches for cross-compilation...)<br>
>>>><br>
>>>> * Tracking of files installed by packages. While unrelated to repo signing, this might have some security implications, so we might want to bring it in.<br>
>>>><br>
>>>> * With file tracking, generating a binary repo (with some limitations) could be quite<br>
>>>> straight-forward.<br>
>>>><br>
>>>><br>
>>>> Which of these do you think is most important ? Have I forgotten anything ?<br>
>>>><br>
>>>> Cheers,<br>
>>>> Louis<br>
>>>><br>
>>>><br>
>>>> [1] <a href="http://theupdateframework.com/" target="_blank">http://theupdateframework.com/</a><br>
>>>> [2] <a href="https://github.com/ocaml/opam/blob/master/doc/design/depexts-plugins" target="_blank">https://github.com/ocaml/opam/blob/master/doc/design/depexts-plugins</a><br>
>>>> [3] <a href="https://github.com/ocaml/opam/blob/master/doc/design/provides.md" target="_blank">https://github.com/ocaml/opam/blob/master/doc/design/provides.md</a><br>
>>>><br>
>>>> message suivi<br>
>>>><br>
>>>> De : Louis Gesbert<br>
>>>> À : <a href="mailto:opam-devel@lists.ocaml.org">opam-devel@lists.ocaml.org</a><br>
>>>> Envoyé : Wed Dec 17 11:07:40 UTC+01:00 2014<br>
>>>> Objet : [opam-devel] OPAM Roadmap -- what next ?<br>
>>>><br>
>>>> Hi all,<br>
>>>><br>
>>>><br>
>>>><br>
>>>> with some lag after the 1.2 release, I'd like to open some space for a<br>
>>>> collective discussion of the priorities for where the energies should go<br>
>>>> next. We have mainly 3 directions for improvements: first, portability,<br>
>>>> with the main goal of a Windows version. Second, agnosticity, with the goal<br>
>>>> to make OPAM more generic, and try and open it to users outside of the<br>
>>>> OCaml community (wouldn't OPAM for Haskell be fun ?). Third, there are<br>
>>>> always lots of features and improvements that have been asked for, and<br>
>>>> would improve the experience of current users.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> So here is a summary of what I've gathered. Feel free to add your own.<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> ## Portability<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Rewrite parallel command engine.** / done.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Native system manipulation (cp, rm, curl...).**<br>
>>>><br>
>>>> These are mostly done through calls to the shell or external programs. It's<br>
>>>><br>
>>>> not very pretty but quite pragmatic actually... until we want to run on<br>
>>>><br>
>>>> Windows without Cygwin. Anyway, this wouldn't be the end of portability<br>
>>>><br>
>>>> issues.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Windows support.**<br>
>>>><br>
>>>> for OPAM itself to begin with. This should be pretty close.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Packages on Windows.**<br>
>>>><br>
>>>> Locate common issues and attempt to find generic fixes.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Allow **direct use of more solvers** or solver servers.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Support cross-compilation**<br>
>>>><br>
>>>> This is quite an open issue at the moment.<br>
>>>><br>
>>>><br>
>>>><br>
>>>> ## Agnosticity<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Isolate OCaml-specific stuff.**<br>
>>>><br>
>>>> E.g. specific opam-file variables. See <a href="http://ocaml-specific.md" target="_blank">ocaml-specific.md</a><br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Separate as plugins**<br>
>>>><br>
>>>> To open the gate to OPAM without these plugins, or with other ones<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Compilers as packages.**<br>
>>>><br>
>>>> This should mostly work now, but needs some tests and strengthening. The<br>
>>>> main<br>
>>>><br>
>>>> thing still to do is to handle the system compiler changes properly ; that<br>
>>>><br>
>>>> part should be made more generic anyway (see discussion on hooks)<br>
>>>><br>
>>>><br>
>>>><br>
>>>> ## Features<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - A **provides** field. Generally useful, but particulary so with<br>
>>>><br>
>>>> compilers-as-packages<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Releasing the **"features" field** for easier package configuration<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Track installed files**<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Improve security**: just checking md5s is quite light ; package scripts<br>
>>>> can<br>
>>>><br>
>>>> write anywhere<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **OS-specific handling of dependencies** (eg dependencies on packages<br>
>>>> from the<br>
>>>><br>
>>>> OS) with plugins (#1519)<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Specify and implement **hooks**<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Find a nicer way to **share dev repos** / undoable "pinning sources"<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Per-switch remotes**<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - **Multi-switch packages**<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Support for (automatic generation of) **binary packages**<br>
>>>><br>
>>>><br>
>>>><br>
>>>> - Nicer **ocamlfind interaction**<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> Cheers,<br>
>>>><br>
>>>> Louis Gesbert<br>
>>>><br>
>>>> ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━<br>
>>>><br>
>>>> opam-devel mailing list<br>
>>>> <a href="mailto:opam-devel@lists.ocaml.org">opam-devel@lists.ocaml.org</a><br>
>>>> <a href="http://lists.ocaml.org/listinfo/opam-devel" target="_blank">http://lists.ocaml.org/listinfo/opam-devel</a><br>
>>>><br>
>>>> ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━<br>
>>>><br>
>>>> opam-devel mailing list<br>
>>>> <a href="mailto:opam-devel@lists.ocaml.org">opam-devel@lists.ocaml.org</a><br>
>>>> <a href="http://lists.ocaml.org/listinfo/opam-devel" target="_blank">http://lists.ocaml.org/listinfo/opam-devel</a><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> Simon<br>
>>><br>
>>>> _______________________________________________<br>
>>>> opam-devel mailing list<br>
>>>> <a href="mailto:opam-devel@lists.ocaml.org">opam-devel@lists.ocaml.org</a><br>
>>>> <a href="http://lists.ocaml.org/listinfo/opam-devel" target="_blank">http://lists.ocaml.org/listinfo/opam-devel</a><br>
>>><br>
>>><br>
>>> --<br>
>>> Roberto Di Cosmo<br>
>>><br>
>>> ------------------------------------------------------------------<br>
>>> Professeur En delegation a l'INRIA<br>
>>> PPS E-mail: <a href="mailto:roberto@dicosmo.org">roberto@dicosmo.org</a><br>
>>> Universite Paris Diderot WWW : <a href="http://www.dicosmo.org" target="_blank">http://www.dicosmo.org</a><br>
>>> Case 7014 Tel : <a href="tel:%2B%2B33-%280%291-57%2027%2092%2020" value="+33157279220">++33-(0)1-57 27 92 20</a><br>
>>> 5, Rue Thomas Mann<br>
>>> F-75205 Paris Cedex 13 Identica: <a href="http://identi.ca/rdicosmo" target="_blank">http://identi.ca/rdicosmo</a><br>
>>> FRANCE. Twitter: <a href="http://twitter.com/rdicosmo" target="_blank">http://twitter.com/rdicosmo</a><br>
>>> ------------------------------------------------------------------<br>
>>> Attachments:<br>
>>> MIME accepted, Word deprecated<br>
>>> <a href="http://www.gnu.org/philosophy/no-word-attachments.html" target="_blank">http://www.gnu.org/philosophy/no-word-attachments.html</a><br>
>>> ------------------------------------------------------------------<br>
>>> Office location:<br>
>>><br>
>>> Bureau 3020 (3rd floor)<br>
>>> Batiment Sophie Germain<br>
>>> Avenue de France<br>
>>> Metro Bibliotheque Francois Mitterrand, ligne 14/RER C<br>
>>> -----------------------------------------------------------------<br>
>>> GPG fingerprint 2931 20CE 3A5A 5390 98EC 8BFC FCCA C3BE 39CB 12D3<br>
>>><br>
>><br>
><br>
> --<br>
> Roberto Di Cosmo<br>
><br>
> ------------------------------------------------------------------<br>
> Professeur En delegation a l'INRIA<br>
> PPS E-mail: <a href="mailto:roberto@dicosmo.org">roberto@dicosmo.org</a><br>
> Universite Paris Diderot WWW : <a href="http://www.dicosmo.org" target="_blank">http://www.dicosmo.org</a><br>
> Case 7014 Tel : <a href="tel:%2B%2B33-%280%291-57%2027%2092%2020" value="+33157279220">++33-(0)1-57 27 92 20</a><br>
> 5, Rue Thomas Mann<br>
> F-75205 Paris Cedex 13 Identica: <a href="http://identi.ca/rdicosmo" target="_blank">http://identi.ca/rdicosmo</a><br>
> FRANCE. Twitter: <a href="http://twitter.com/rdicosmo" target="_blank">http://twitter.com/rdicosmo</a><br>
> ------------------------------------------------------------------<br>
> Attachments:<br>
> MIME accepted, Word deprecated<br>
> <a href="http://www.gnu.org/philosophy/no-word-attachments.html" target="_blank">http://www.gnu.org/philosophy/no-word-attachments.html</a><br>
> ------------------------------------------------------------------<br>
> Office location:<br>
><br>
> Bureau 3020 (3rd floor)<br>
> Batiment Sophie Germain<br>
> Avenue de France<br>
> Metro Bibliotheque Francois Mitterrand, ligne 14/RER C<br>
> -----------------------------------------------------------------<br>
> GPG fingerprint 2931 20CE 3A5A 5390 98EC 8BFC FCCA C3BE 39CB 12D3<br>
><br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div>Roberto Di Cosmo</div><div> </div><div>------------------------------------------------------------------</div><div>Professeur En delegation a l'INRIA</div><div>PPS E-mail: <a href="mailto:roberto@dicosmo.org" target="_blank">roberto@dicosmo.org</a></div><div>Universite Paris Diderot WWW : <a href="http://www.dicosmo.org" target="_blank">http://www.dicosmo.org</a></div><div>Case 7014 Tel : ++33-(0)1-57 27 92 20</div><div>5, Rue Thomas Mann </div><div>F-75205 Paris Cedex 13 Identica: <a href="http://identi.ca/rdicosmo" target="_blank">http://identi.ca/rdicosmo</a></div><div>FRANCE. Twitter: <a href="http://twitter.com/rdicosmo" target="_blank">http://twitter.com/rdicosmo</a></div><div>------------------------------------------------------------------</div><div>Attachments:</div><div>MIME accepted, Word deprecated</div><div> <a href="http://www.gnu.org/philosophy/no-word-attachments.html" target="_blank">http://www.gnu.org/philosophy/no-word-attachments.html</a></div><div>------------------------------------------------------------------</div><div>Office location:</div><div> </div><div>Bureau 320 (3rd floor)</div><div>Batiment Sophie Germain</div><div>Avenue de France</div><div>Metro Bibliotheque Francois Mitterrand, ligne 14/RER C</div><div>-----------------------------------------------------------------</div>GPG fingerprint 2931 20CE 3A5A 5390 98EC 8BFC FCCA C3BE 39CB 12D3 </div></div>
</div>