Re: Isar fork

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi,

On 10/18/2017 04:02 PM, 'Ben Brenson' via isar-users wrote:
> Root privileges inside a Docker container are sadly not a good enough
>> security mechanism, because you would have to grant the container the
>> sys_admin capabilities for loop mount and now its able to potentially
>> overwrite disk content or access the complete host memory.
>>
> 
> So the best solution would be to implement a non-root approach. Otherwise
> there will always persist some security issues.
> For now I don't have any solutions, yet.
> A time ago I tried to setup debootstrap by using fakechroot, but that
> wasn't staight forward to solve.
> Maybe with multistrap, things would be much easier here?

AFAIK that not the case. One problem of fakeroot/fakechroot is that is 
works with LD_PRELOAD and therefor fails with static binaries. proot is 
better there because is uses the same mechanism as strace (ptrace) to 
capture syscalls. proot also allows to pseudo bind mount directories 
into the chroot-path, which is useful. The problem with proot is however 
that chown/chmod/mknot calls are not stored persistently.

So when I read 'schroot' in your commit history I got exited and hoped 
that is the solution we all waited for. Doesn't seem to be the case though.

Cheers,
Claudius

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de