Use user namespaces!

[amluto]

This is a draft of user namespace support. --uid, --gid, and setuid root support are gone!

The sequence of events looks like:

unshare(CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|CLONE_NEWPID) = 0
mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
mount("/mnt/test", "/tmp/sandstorm-grain", NULL, MS_BIND, NULL) = 0
mount("/mnt/test", "/tmp/sandstorm-grain", NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
chdir("/tmp/sandstorm-grain")           = 0
mount("sandstorm-tmp", "tmp", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NOATIME, "size=16m,nr_inodes=4k,mode=770") = 0
mount("sandstorm-dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NOATIME, "size=1m,nr_inodes=16,mode=755") = 0
mount("/dev/null", "dev/null", NULL, MS_BIND, NULL) = 0
mount("/dev/zero", "dev/zero", NULL, MS_BIND, NULL) = 0
mount("/dev/random", "dev/random", NULL, MS_BIND, NULL) = 0
mount("/dev/urandom", "dev/urandom", NULL, MS_BIND, NULL) = 0
mount("dev", "dev", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain/sandbox", "var", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain/sandbox", "var", NULL, MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
mount("/proc", "proc", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain", "usr", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain", "usr", NULL, MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
pivot_root(".", "usr/sandbox")          = 0
chdir("/usr")                           = 0
umount("sandbox", MNT_DETACH)           = 0
umount("/usr", MNT_DETACH)              = 0
** SANDSTORM SUPERVISOR: Starting up grain.
Process 28771 attached
[pid 28771] chdir("/")                  = 0
[pid 28771] unshare(CLONE_NEWNET)       = 0
[pid 28771] mount("proc", "usr", NULL, MS_MOVE, NULL) = 0
[pid 28771] mount("proc", "proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL) = 0
[pid 28771] umount("usr", MNT_DETACH)   = 0

[amluto]

It occurs to me that this might allow sandstorm to run inside Docker.

[kentonv]

This is awesome and I'm excited to merge it.

Currently, it looks like AWS and GCE both default to kernel 3.10 and don't provide any particularly easy way to upgrade (you can compile your own kernel, but that's not exactly turnkey). I see that 3.12 is being dubbed a long-term release as well, so there's at least some chance they'll switch over, but I have no idea how to determine if/when this might actually happen.

It would be pretty sad if people couldn't easily run instances on AWS/GCE, but maybe supporting Docker better would be worth it. Maybe we just need to provide decent instructions for updating the kernel on these targets.

Thoughts?

[amluto]

I'm reasonably happy with this now.

[kentonv]

Yay, no more suid-root supervisor!

Now to use UID namespaces in run-bundle as well, so that it need not be root... and then maybe we can make Sandstorm work in Docker.