<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; color: #000000"><div>Thanks for your answer.<br>Looks like there is good ressources . </div><div><br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif;">Cordialement,</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></span></div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;">Benoît Georgelin</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Luis M. Ibarra" <michael.ibarra@gmail.com><br><b>À: </b>"lxc-users" <lxc-users@lists.linuxcontainers.org><br><b>Envoyé: </b>Lundi 17 Août 2015 12:41:43<br><b>Objet: </b>Re: [lxc-users] LXC and Unprivileged containers - purpose and status - talks<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div>Hi all,<br><br></div>There's going to be excellent talks in ContainerCon[1] this week, but I don't know if the talks are going to be streamed later.<br><div><div><div><div><br>For User Namespaces, I follow this tutorial[2] which explains pretty well how user namespaces work. Also, check user_namespaces(7) and capabilities(7), here you find pretty much how linux capabilities is used in conjunction with user namespaces to get super user inside the container regarding being created as a normal user in the host. <br></div><div>Finally, in lxd/specs/userns-idmap[3] you'll find many cases where user namespaces can save your life if things go really wrong. <br></div><br><div>If you want a simple solution of unpriv containers, you should check LXD which is really awesome, but it's still in heavy development.<br><br><br>[1] <a href="http://events.linuxfoundation.org/events/containercon/program/schedule" target="_blank" data-mce-href="http://events.linuxfoundation.org/events/containercon/program/schedule">http://events.linuxfoundation.org/events/containercon/program/schedule</a><br>[2] <a href="https://www.youtube.com/watch?v=kKCdPouT-dQ" target="_blank" data-mce-href="https://www.youtube.com/watch?v=kKCdPouT-dQ">https://www.youtube.com/watch?v=kKCdPouT-dQ</a><br>[3] <a href="https://github.com/lxc/lxd/blob/master/specs/userns-idmap.md" target="_blank" data-mce-href="https://github.com/lxc/lxd/blob/master/specs/userns-idmap.md">https://github.com/lxc/lxd/blob/master/specs/userns-idmap.md</a><br><br><br><br></div><div>Greetings, <br><br></div><div><br><br></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-08-17 3:17 GMT-05:00 Narcis Garcia <span dir="ltr"><<a href="mailto:informatica@actiu.net" target="_blank" data-mce-href="mailto:informatica@actiu.net">informatica@actiu.net</a>></span>:<br><blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;" data-mce-style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">I've read somewhere:<br> "Ubuntu is also one of the few (if not only) Linux distributions to come<br> by default with everything that's needed for safe, unprivileged LXC<br> containers" - and not LTS versions.<br> <br> <br> El 17/08/15 a les 06:48, Benoit GEORGELIN - Association Web4all ha escrit:<br><div><div class="h5">> Hi lxc-users :)<br> ><br> > I'm currently working and playing around with LXC containers. I came<br> > across "Unprivileged Containers"<br> > I would like to get some feedback about this really interesting feature.<br> > It's not easy to get a good tour about the technology and about the<br> > maturity of this kind of containers. First because I'm not technical<br> > enough to understand the differences between LXC and OpenVZ (besides<br> > Cgroups and kernels needs) , second because I'm not able to find<br> > documentation, talks or paper about it.<br> > I'm here to talk about it, try to merge information from you guys and<br> > eventually make something public that can be shared to everyone having<br> > the same questions :)<br> ><br> > As I'm looking at containers for shared environments, I'm more concerned<br> > about security. There is few concerns I have regarding LXC with both<br> > privileged and unprivileged containers.<br> ><br> > -Network stand point<br> ><br> > By default LXC have great network management and integration (with<br> > privileged containers) but this is without any secure solution about<br> > network spoofing (MAC, IP, Etc..)<br> > I know, maybe it's not LXC's business to manage network like that, but<br> > looking how good is the project seems to be, I'm really surprised there<br> > is not any solutions that comes with LXC to integrate those kind of<br> > (basics) security.<br> ><br> > One container=>One MAC address=> One or more specifics IP address.<br> ><br> > Even if the goal of linuxcontainers is to be "vendor neutral" I think<br> > there something missing here to be more "user friendly" and "out of the<br> > box" . I think most of LXC user will have more than one containers to<br> > deploy and it may be the best to provide easy integrated solution<br> > regarding this specific<br> > aspect of networking.<br> ><br> > I Have been using OpenVswitch (Open Flow) to add such security but from<br> > what I can tell, this is not documented and self learning on those<br> > technology take a long time. You can see the archive here<br> > : <a href="https://www.mail-archive.com/lxc-users@lists.linuxcontainers.org/msg03609.html" rel="noreferrer" target="_blank" data-mce-href="https://www.mail-archive.com/lxc-users@lists.linuxcontainers.org/msg03609.html">https://www.mail-archive.com/lxc-users@lists.linuxcontainers.org/msg03609.html</a><br> ><br> > (?) What should the position be when you need to deploy lots of LXC<br> > containers and give root access to the container ?<br> > The question doesn't happen with unprivileged containers, looks like<br> > there is no way to change network info, but this is not the solution if<br> > you wanna run privileged containers and stay safe.<br> ><br> > - System security stand point<br> ><br> > Dmesg<br> > As a simple and quick test, dmesg information of the HOST are in the<br> > unprivileged container.<br> > (?) Maybe there is a technical limit about that ?<br> ><br> > (?) What can be the best way to understand more how build are<br> > unprivileged container and what can be done to help . Is this only about<br> > Cgroups? Apparmor ? both?<br> > Maybe have more information about the interaction between security parts<br> > will be a nice to have :)<br> ><br> ><br> > - Maturity of the solution with unprivileged containers.<br> > I know there is a lot of things going on with this kind of containers. I<br> > would like to know more about the perspective and the goal .<br> ><br> > (?) what unprivileged containers are made for ?<br> > (?) Is this only to prevent security issues from any process running out<br> > of an LXC (privileged) container ?<br> > Or is it more to give the opportunity to no-root user to execute<br> > LXC containers ?<br> ><br> > (?) Let's say it's for security purpose only in case of a process<br> > running out of a container, how big is the possibility that happen ?<br> > from one to ten ?<br> ><br> > Story of my first experience with unprivileged container :<br> ><br> > I'm running debian jessie to try my first unprivileged container.<br> > lxc-create -n debian8 -t downlowd -- -d debian -r jessie -a amd64<br> ><br> > First thing I wanna do, install sshd daemon . No problem.<br> > Second thing, starting sshd after install : service sshd restart .<br> > Result: [sshd] <defunct><br> > Looks like there is something weird...<br> > service sshd start : Result : Process running<br> > But wait, not able to connect . :/<br> > I had to : sed -ri 's/^session\s+required\s+pam_loginuid.so$/session<br> > optional <a href="http://pam_loginuid.so/" rel="noreferrer" target="_blank" data-mce-href="http://pam_loginuid.so/">pam_loginuid.so/</a>' /etc/pam.d/sshd<br> ><br> > (?) Now I can connect but "pam_loginuid" cannot be used at all ?<br> ><br> > Then , what can I see, every SSHD connection failure show a new sshd<br> > <defunct> process<br> ><br> > ps auxf|grep sshd|grep defunct|wc -l<br> > 503<br> ><br> > (?) any idea or know problem ? Is something on my configuration ?<br> ><br> > It happen with others process like :<br> > [chef-client] <defunct><br> > [bash] <defunct><br> > [sshd] <defunct><br> ><br> > I just wanna understand if those issue are definitively a miss<br> > configuration on my side or that can be easily explained ? :(<br> ><br> > - init.d with unprivileged<br> > (?) Maybe because I have a lack of knowledge in this area, but why<br> > there is nothing starting up automatically from a unprivileged container ?<br> > (?) What can be used as a workaround ?<br> ><br> ><br> > Well, beside those points, I can get an unprivileged container running<br> > httpd, php5, mysql :)<br> > Pretty quick and easy . Templates are a very good thing to use . (thx)<br> ><br> > Now I'm looking forward to read your experience and share some technical<br> > or unprivileged containers story !<br> ><br> > Cheers,<br> ><br> ><br> > Cordialement,<br> ><br> > Benoît Georgelin<br> > Afin de contribuer au respect de l'environnement, merci de n'imprimer ce<br> > mail qu'en cas de nécessité<br> ><br> ><br> ><br></div></div>> _______________________________________________<br> > lxc-users mailing list<br> > <a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank" data-mce-href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br> > <a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank" data-mce-href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br> ><br> _______________________________________________<br> lxc-users mailing list<br> <a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank" data-mce-href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br> <a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank" data-mce-href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">Luis M. Ibarra</div></div><br>_______________________________________________<br>lxc-users mailing list<br>lxc-users@lists.linuxcontainers.org<br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></div></div></body></html>