kentonv/sandstorm — pull request #12 by amluto (2014-04-26 05:39:15+00:00)
Title: Use user namespaces!

This is a draft of user namespace support. --uid, --gid, and setuid root support are gone!

The sequence of events looks like:
```
unshare(CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|CLONE_NEWPID) = 0
mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
mount("/mnt/test", "/tmp/sandstorm-grain", NULL, MS_BIND, NULL) = 0
mount("/mnt/test", "/tmp/sandstorm-grain", NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
chdir("/tmp/sandstorm-grain") = 0
mount("sandstorm-tmp", "tmp", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NOATIME, "size=16m,nr_inodes=4k,mode=770") = 0
mount("sandstorm-dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NOATIME, "size=1m,nr_inodes=16,mode=755") = 0
mount("/dev/null", "dev/null", NULL, MS_BIND, NULL) = 0
mount("/dev/zero", "dev/zero", NULL, MS_BIND, NULL) = 0
mount("/dev/random", "dev/random", NULL, MS_BIND, NULL) = 0
mount("/dev/urandom", "dev/urandom", NULL, MS_BIND, NULL) = 0
mount("dev", "dev", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain/sandbox", "var", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain/sandbox", "var", NULL, MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
mount("/proc", "proc", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain", "usr", NULL, MS_BIND, NULL) = 0
mount("/var/sandstorm/grains/rootgrain", "usr", NULL, MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_NOATIME|MS_BIND, NULL) = 0
pivot_root(".", "usr/sandbox") = 0
chdir("/usr") = 0
umount("sandbox", MNT_DETACH) = 0
umount("/usr", MNT_DETACH) = 0
** SANDSTORM SUPERVISOR: Starting up grain.
Process 28771 attached
[pid 28771] chdir("/") = 0
[pid 28771] unshare(CLONE_NEWNET) = 0
[pid 28771] mount("proc", "usr", NULL, MS_MOVE, NULL) = 0
[pid 28771] mount("proc", "proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL) = 0
[pid 28771] umount("usr", MNT_DETACH) = 0
```