subuser, benefit or liability? [closed]

Question

I'm trying various sandboxing solutions on linux. I'm used to running untrusted programs (for example, a web browser, a pdf document reader, etc) inside a selinux sandbox, which I'm quite satisfied with, but there is a problem: it's only supported on rhel/fedora. AFAIK other distributions don't really support selinux (even when they say they do, they don't ship usable policies or documentation), and even when a quasi-working policy is provided, policycoreutils-sandbox is not available (see debian).

What could be a multi-distro sandboxing solution? I'm trying docker/subuser, which allows me to start a docker container running the application of interest and giving it access only to part of the filesystem. For example, I can run 'chrome' in a docker container and let it only access my Downloads directory.

This seems a convenient solution since it's distribution independent and doesn't require me to install the program I'm planning to run and its dependencies on the host.

However, I'm not quite sure about how much security is there in 'subuser-security': https://github.com/subuser-security/subuser

First of all, docker doesn't yet support user namespaces. This means that every 'container' runs as root on my host, even if it's isolated by lxc. this also means that, if I follow subuser's recommendations, I have to add my user to the docker group. since dockerd runs as root, having access to it means that I have full access to the whole host filesystem as root, I can run privileged containers, etc. If this isn't enabling privilege escalation (even if not from 'guest' apps, I hope), I don't know what it is.

furthermore, let's say that I'm running chrome in subuser. Now I have a chrome browser running with its sandbox disabled (one less layer) inside another sandbox under the root user. Is it really a benefit from simply running chrome with its sandbox under an unprivileged user?

I would not be able to limit its access to my home directory, but apart from that, I don't see reasons to prefer subuser/docker.

what other distro independent solutions are left?

I'm starting to think that the least cumbersome solution would be to simply use standard unix users. One user per application, maybe install an app and its dependencies under ~local, ~bin, etc.

which package managers support installing a package, mantaining a package tree, as a user inside a user's home directory? are there any third party package managers for linux that support this?

how would you share files between users? I'm thinking of the possibility of running an unprivileged ftp daemon on localhost, let's say as a 'standard' or 'storage' user and use virtual users to export parts of that home dir (eg, /home/me/apps/webdownloads) to other users, applications, and mount that via fuse.

Is this reasonable?

Answer 1

I am Timothy Hobbs, the author of subuser. I'd like you to first read my article on subuser's security philosophy so that you can see what I'm aiming for. I'm aiming for protecting a wide user base from run of the mill attacks, and not for protecting specifically targeted users from the NSA/other nefarious organizations.

First of all, docker doesn't yet support user namespaces. This means that every 'container' runs as root on my host, even if it's isolated by lxc.

While current versions of subuser still build the image as root, subusers do not run as root unless specifically specified to do so.

this also means that, if I follow subuser's recommendations, I have to add my user to the docker group. since dockerd runs as root, having access to it means that I have full access to the whole host filesystem as root, I can run privileged containers, etc. If this isn't enabling privilege escalation (even if not from 'guest' apps, I hope), I don't know what it is.

It is true that Docker, and as consequence, subuser, gives the normal user full root privileges. I do consider this to be a flaw in Docker. I will certainly try to alleviate this problem, if the Docker folks don't do it for me. However, on a single user system, I do not believe that it is a security problem for the normal user to have root access. Because if someone gets control of the normal user, that is just as bad as root. It's really a question of what you are trying to protect: system integrity or your data and your privacy.

furthermore, let's say that I'm running chrome in subuser. Now I have a chrome browser running with its sandbox disabled (one less layer) inside another sandbox under the root user. Is it really a benefit from simply running chrome with its sandbox under an unprivileged user?

Chrome is a special case. It is the only program that I have come across that has this limitation. I do not recommend that you run chrome in subuser.

I'm starting to think that the least cumbersome solution would be to simply use standard unix users. One user per application, maybe install an app and its dependencies under ~local, ~bin, etc.

I certainly considered this approach when designing subuser. However, sharing files between users is either messy, insecure, or both. Furthermore, you can't simply display x11 windows from other users to your user's x11 server. You have to set up XPRA, VNC, RPC or some other network solution. This is tedious, and one of the main goals of subuser is to eliminate the tedium of such a setup.

which package managers support installing a package, mantaining a package tree, as a user inside a user's home directory? are there any third party package managers for linux that support this?

There are many package managers that support installing programs as normal users. You can see an incomplete list http //subuser.org/related-projects.html (not enough reputation to post more than 2 links) on the subuser website. Just scroll down till you get to zero-install. Of course, these package managers don't do anything in terms of security.

```` how would you share files between users? I'm thinking of the possibility of running an unprivileged ftp daemon on localhost, let's say as a 'standard' or 'storage' user and use virtual users to export parts of that home dir (eg, /home/me/apps/webdownloads) to other users, applications, and mount that via fuse.

Is this reasonable? ````

The sub-identity toolkit http //ccl.cse.nd.edu/software/subid/ (not enough reputation to post more than two links) provides a tool named subuserchown which assists in sharing files between users.