Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Eval stuff securely #25

Open
AlexDaniel opened this issue Aug 20, 2016 · 5 comments
Open

Eval stuff securely #25

AlexDaniel opened this issue Aug 20, 2016 · 5 comments
Labels
whateverable Issues affecting the bot framework (and therefore all of the bots)

Comments

@AlexDaniel
Copy link
Member

This is going to be easy once the work on #23 is finished.
AlexDaniel added a commit that referenced this issue Aug 25, 2016
@AlexDaniel
Restore SLIGHTLY-RESTRICTED setting
326c44a 
Guess what, we kinda lost it during the transition to Perl 6 bots.

In fact, now I see that not all of the things were restricted. Whoops!

Hopefully we will be able to get rid of it soon. See issue #25.
@MasterDuke17
Copy link
Collaborator

This could also solve the problem we've been having recently where a bot dies and leave the rakudo directory for the commit it was currently using lying around. This blocks any other bots from running with that commit. This is particularly problematic because a high percentage of the bot invocations use HEAD, so if the bot dies it could essentially prevent most use of the other bots.

@MasterDuke17
Copy link
Collaborator

A short term solution would be to add the name of the bot to the path it extracts into, then at least if it dies it won't block the other bots.

@AlexDaniel
Copy link
Member Author

A short term solution would be to add the name of the bot to the path it extracts into, then at least if it dies it won't block the other bots.

That would mean building rakudo three times for each commit…

@MasterDuke17
Copy link
Collaborator

Ugh, right, forgot that paths are hard-coded when it's built.

@AlexDaniel AlexDaniel added all bots Issues affecting all (or most) of the bots whateverable Issues affecting the bot framework (and therefore all of the bots) and removed all bots Issues affecting all (or most) of the bots labels Sep 21, 2016
@AlexDaniel AlexDaniel mentioned this issue Sep 22, 2016
Open
This was referenced Oct 18, 2016
Open
Open
@AlexDaniel AlexDaniel changed the title Run snippets in LXC (or docker?) containers (no more RESTRICTED setting) Eval stuff securely Dec 16, 2016
@AlexDaniel AlexDaniel added the testneeded Issue is generally resolved but tests were not written yet label Jan 6, 2017
@AlexDaniel AlexDaniel removed the testneeded Issue is generally resolved but tests were not written yet label Mar 12, 2017
@AlexDaniel AlexDaniel mentioned this issue May 26, 2017
Closed
@AlexDaniel AlexDaniel mentioned this issue Jul 21, 2017
Open
AlexDaniel added a commit that referenced this issue Sep 29, 2017
@AlexDaniel
I ♥ systemd
845db2e 
This commit resolves many long-standing problems:

* Issue #25 (RESTRICTED setting) is resolved. Bots are still not fully
  secure, but now they are more secure that they've even been given
  that RESTRICTED setting is entirely useless
* Issue #52 (predictable filenames) is no longer blocked
* Issue #55 (sandboxable) is probably no longer relevant
* Issue #118 (ramfs for /tmp) now needs an update
* Issue #144 (bots leaving stuff behind) is resolved because every bot
  has its own /tmp
* Issue #183 (source ip issue) possibly has a systemd solution for it
* Issue #197 is tackled a little bit also because now there's a memory
  limit for every bot (3G for now, we can probably make it smaller)
* Issue #238 (e.g. forkbombs) is basically resolved, but needs a bit more work
* Moreover, there's now a watchdog that makes sure that bots come back
  online if something bad happens

Not that all of this wasn't possible without systemd, it's just that
it is so much easier now. Feel free to hate me as much as you want.
@AlexDaniel
Copy link
Member Author

To resolve this fully we'd need to set SystemCallFilter and some other things also. It will always be a balance between tightening the nuts and letting people run stuff freely, but right now we're a bit too forgiving.

@AlexDaniel AlexDaniel mentioned this issue Apr 9, 2019
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
whateverable Issues affecting the bot framework (and therefore all of the bots)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@AlexDaniel @MasterDuke17