Repository navigation
strict: a UID of its own for every sandbox (#27) - #47
Merged
Merged
Conversation
Every isolation: strict sandbox ran its VMM as the same subordinate UID, so a guest that escaped both its VM and its VMM could reach every other strict sandbox's /data. Now each strict sandbox gets its own slot of 65536 IDs from the user's subordinate range, recorded with the sandbox and freed on destroy; a fork shares its parent's. podman's --uidmap, the Firecracker jail's process identity, its disk and sockets all use the slot. /data belongs to the slot's UID, with your group and mode 0750, so you can still read it and no other sandbox's UID can. When the range has no free slot, box refuses to start the sandbox and prints the usermod line that adds one, rather than let two sandboxes share a UID; box doctor shows the capacity. Also fixed on the way: files imported or restored into a strict sandbox's /data were left owned by you, so the guest could read but not change them; they are now given to the sandbox. A destroyed sandbox's kept /data is handed back to you, so the next sandbox given its slot does not own it. The slot allocator counts every sandbox directory, Boxfile or not. The escape suite gains an "other sandboxes" section: the VMM's UID owns this sandbox's /data, /data is closed to others, and a UID from another slot cannot read it (skipped, and said so, when the range has one slot). podman and firecracker strict: no escapes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #27. Part of #30 and the v0.5 milestone.
Every
isolation: strictsandbox ran its VMM as the same subordinate UID, so a guest that escaped both its VM and its VMM could reach every other strict sandbox's/data. Now each strict sandbox runs as a UID of its own.How it works
--uidmap/--gidmap, the Firecracker jail's process identity, its/datadisk and sockets all use the slot./databelongs to the slot's UID with your group and mode 0750: you can still read it, no other sandbox's UID can. The Firecracker disk is 0600.usermodline that adds a non-overlapping range, instead of letting two sandboxes share a UID.box doctorshows how many strict sandboxes the range holds.Fixed on the way
box data import) or restored into a strict sandbox's/datawere left owned by you, so the guest could read but not change them. They are now given to the sandbox./datais handed back to you, so the next sandbox given its slot does not own it.Tests
/datais524288:1000 0750; a second strict sandbox is refused with the fix on a one-slot range; destroying the first hands its data back and the second gets the freed slot; imported files are owned by the sandbox and writable by its guest./data;/datais closed to others; a UID from another slot cannot read it. podman strict and firecracker strict: no escapes.Not yet verified
The live "read as another slot's UID" check needs a range with two or more slots; on the test machine (65536 IDs) it is skipped and reported as skipped. Run
security/escape-test.sh ./box stricton a machine with a larger/etc/subuidrange to exercise it.Upgrade note
Default
/etc/subuidranges are 65536 IDs: one strict sandbox. A second one now stops with the fix instead of sharing a UID. Release notes for v0.5 must say so.