Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread R0b0t1
On Fri, Sep 22, 2017 at 5:01 PM, Michael Orlitzky wrote: > On 09/22/2017 05:51 PM, R0b0t1 wrote: >> On Thu, Sep 21, 2017 at 2:56 PM, Michał Górny wrote: >>> [1]:https://wiki.gentoo.org/wiki/Project:Sandbox >>> >> >> I think I understand, in principle, why a sandbox could be useful, but >> would i

Re: [gentoo-dev] An example overlayfs sandbox test

2017-09-22 Thread Rich Freeman
On Fri, Sep 22, 2017 at 6:29 PM, James McMechan wrote: > On Fri, Sep 22, 2017 at 5:18 PM, Rich Freeman wrote: >>On Fri, Sep 22, 2017 at 4:43 PM, James McMechan >> wrote: >>> >>> # now create a separate mount namespace non-persistent >>> unshare -m bash >>> >> >>If you're going to go to the troubl

Re: [gentoo-dev] An example overlayfs sandbox test

2017-09-22 Thread James McMechan
On Fri, Sep 22, 2017 at 5:18 PM, Rich Freeman wrote: >On Fri, Sep 22, 2017 at 4:43 PM, James McMechan > wrote: >> >> # now create a separate mount namespace non-persistent >> unshare -m bash >> > >If you're going to go to the trouble to set up a container, you might >as well add some more isolatio

Re: [gentoo-dev] An example overlayfs sandbox test

2017-09-22 Thread Rich Freeman
On Fri, Sep 22, 2017 at 4:43 PM, James McMechan wrote: > > # now create a separate mount namespace non-persistent > unshare -m bash > If you're going to go to the trouble to set up a container, you might as well add some more isolation: unshare --mount --net --pid --uts --cgroup --fork --ipc --m

[gentoo-dev] An example overlayfs sandbox test

2017-09-22 Thread James McMechan
Hello, I thought a example of how a overlay sandbox could work was in order. ### # load the overlayfs filesystem for this test modprobe overlay # make the directories for the test mkdir -p /var/tmp/upper /var/tmp/work /mnt/gentoo # now create a separate mount namespace non-persistent unshare -m

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Alec Warner
On Fri, Sep 22, 2017 at 5:51 PM, R0b0t1 wrote: > On Thu, Sep 21, 2017 at 2:56 PM, Michał Górny wrote: > > [1]:https://wiki.gentoo.org/wiki/Project:Sandbox > > > > I think I understand, in principle, why a sandbox could be useful, but > would it not be more productive to follow up with projects w

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Michael Orlitzky
On 09/22/2017 05:51 PM, R0b0t1 wrote: > On Thu, Sep 21, 2017 at 2:56 PM, Michał Górny wrote: >> [1]:https://wiki.gentoo.org/wiki/Project:Sandbox >> > > I think I understand, in principle, why a sandbox could be useful, but > would it not be more productive to follow up with projects which do > un

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread R0b0t1
On Thu, Sep 21, 2017 at 2:56 PM, Michał Górny wrote: > [1]:https://wiki.gentoo.org/wiki/Project:Sandbox > I think I understand, in principle, why a sandbox could be useful, but would it not be more productive to follow up with projects which do unexpected things to ask that they not do those thin

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Michał Górny
W dniu pią, 22.09.2017 o godzinie 20∶31 +0200, użytkownik Alexis Ballier napisał: > On Fri, 22 Sep 2017 19:39:16 +0200 > Michał Górny wrote: > > > W dniu pią, 22.09.2017 o godzinie 19∶15 +0200, użytkownik Alexis > > Ballier napisał: > > > On Fri, 22 Sep 2017 17:20:23 +0200 > > > Michał Górny wro

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Alexis Ballier
On Fri, 22 Sep 2017 19:39:16 +0200 Michał Górny wrote: > W dniu pią, 22.09.2017 o godzinie 19∶15 +0200, użytkownik Alexis > Ballier napisał: > > On Fri, 22 Sep 2017 17:20:23 +0200 > > Michał Górny wrote: > > > > > W dniu pią, 22.09.2017 o godzinie 12∶57 +0200, użytkownik Alexis > > > Ballier

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Michał Górny
W dniu pią, 22.09.2017 o godzinie 19∶15 +0200, użytkownik Alexis Ballier napisał: > On Fri, 22 Sep 2017 17:20:23 +0200 > Michał Górny wrote: > > > W dniu pią, 22.09.2017 o godzinie 12∶57 +0200, użytkownik Alexis > > Ballier napisał: > > > On Fri, 22 Sep 2017 06:07:18 +0200 > > > Michał Górny wro

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Patrick McLean
On 2017-09-22 10:03 AM, Brian Dolbec wrote: > On Fri, 22 Sep 2017 15:06:49 + > James McMechan wrote: > >> On Fri, Sep 22, 2017 at 5:27 AM, Rich Freeman >> wrote: >>> On Fri, Sep 22, 2017 at 7:38 AM, Sergei Trofimovich >>> wrote: Some other distros try harder to isolate build

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Alexis Ballier
On Fri, 22 Sep 2017 17:20:23 +0200 Michał Górny wrote: > W dniu pią, 22.09.2017 o godzinie 12∶57 +0200, użytkownik Alexis > Ballier napisał: > > On Fri, 22 Sep 2017 06:07:18 +0200 > > Michał Górny wrote: > > > > > W dniu czw, 21.09.2017 o godzinie 15∶41 -0700, użytkownik Matt > > > Turner nap

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Brian Dolbec
On Fri, 22 Sep 2017 15:06:49 + James McMechan wrote: > On Fri, Sep 22, 2017 at 5:27 AM, Rich Freeman > wrote: > >On Fri, Sep 22, 2017 at 7:38 AM, Sergei Trofimovich > > wrote: > >> > >> Some other distros try harder to isolate build environment either > >> through chroot and/or private mo

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Michał Górny
W dniu pią, 22.09.2017 o godzinie 12∶57 +0200, użytkownik Alexis Ballier napisał: > On Fri, 22 Sep 2017 06:07:18 +0200 > Michał Górny wrote: > > > W dniu czw, 21.09.2017 o godzinie 15∶41 -0700, użytkownik Matt Turner > > napisał: > > > On Thu, Sep 21, 2017 at 2:25 PM, Michał Górny > > > wrote:

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread James McMechan
On Fri, Sep 22, 2017 at 5:27 AM, Rich Freeman wrote: >On Fri, Sep 22, 2017 at 7:38 AM, Sergei Trofimovich wrote: >> >> Some other distros try harder to isolate build environment either >> through chroot and/or private mount/user/network namespace that >> contains only explicitly specified files

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Rich Freeman
On Fri, Sep 22, 2017 at 7:38 AM, Sergei Trofimovich wrote: > > Some other distros try harder to isolate build environment either > through chroot and/or private mount/user/network namespace that > contains only explicitly specified files in build environment. > > That would require more cooperatio

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Alexis Ballier
On Fri, 22 Sep 2017 12:38:54 +0100 Sergei Trofimovich wrote: > On Fri, 22 Sep 2017 12:57:21 +0200 > Alexis Ballier wrote: > > > On Fri, 22 Sep 2017 06:07:18 +0200 > > Michał Górny wrote: > > > > > W dniu czw, 21.09.2017 o godzinie 15∶41 -0700, użytkownik Matt > > > Turner napisał: > > >

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Sergei Trofimovich
On Fri, 22 Sep 2017 12:57:21 +0200 Alexis Ballier wrote: > On Fri, 22 Sep 2017 06:07:18 +0200 > Michał Górny wrote: > > > W dniu czw, 21.09.2017 o godzinie 15∶41 -0700, użytkownik Matt Turner > > napisał: > > > On Thu, Sep 21, 2017 at 2:25 PM, Michał Górny > > > wrote: > > > > Given that

Re: [gentoo-dev] Reviving the Sandbox project

2017-09-22 Thread Alexis Ballier
On Fri, 22 Sep 2017 06:07:18 +0200 Michał Górny wrote: > W dniu czw, 21.09.2017 o godzinie 15∶41 -0700, użytkownik Matt Turner > napisał: > > On Thu, Sep 21, 2017 at 2:25 PM, Michał Górny > > wrote: > > > Given that sandbox is utterly broken by design, I don't really > > > want to put too much