What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.
Comments
What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
Use Linux containers (lxc). Exactly what you need...
Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
I'll have a dig into that next then - thanks! :-)
I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.