Continuum

Allow running builds in a chroot jail

Details

  • Type: New Feature New Feature
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: 1.1
  • Fix Version/s: None
  • Component/s: Core system
  • Complexity:
    Intermediate
  • Number of attachments :
    0

Description

A nice feature would be to run continuum builds in chroot environments to avoid possible malicious commands and so a project can't access files from another project

The distinction could be per project group

Issue Links

relates to

Improvement - An improvement or enhancement to an existing feature or task. CONTINUUM-1465 Project groups should probably get their own local maven repo

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Wendy Smoak added a comment -

Does this include separate local repositories for each project group?

Show
Wendy Smoak added a comment - Does this include separate local repositories for each project group?
Hide
Permalink
Carlos Sanchez added a comment -

yes, they must be separate because the jail wont allow you to see anything else

Show
Carlos Sanchez added a comment - yes, they must be separate because the jail wont allow you to see anything else
Hide
Permalink
Ignacio G. Mac Dowell added a comment -

I would suggest making distributed builds possible within continuum. If this was possible, installing the agents on different vservers (this would be my choice) on the same machine would IMHO make a superior (and portable - you wouldn't need them to be vservers) solution.

Show
Ignacio G. Mac Dowell added a comment - I would suggest making distributed builds possible within continuum. If this was possible, installing the agents on different vservers (this would be my choice) on the same machine would IMHO make a superior (and portable - you wouldn't need them to be vservers) solution.
Hide
Permalink
Wendy Smoak added a comment -

There is a separate issue open for distributed builds: http://jira.codehaus.org/browse/CONTINUUM-1666

Some of this work (the separate local repos) should also help with parallel builds.

Show
Wendy Smoak added a comment - There is a separate issue open for distributed builds: http://jira.codehaus.org/browse/CONTINUUM-1666 Some of this work (the separate local repos) should also help with parallel builds.
Hide
Permalink
Carlos Sanchez added a comment -

right now the builds run chrooted but I was told the user could escape the chroot jail

in AbstractBuildExecutor the chroot call should be followed with a "su username" with an user that has no privileges.

Show
Carlos Sanchez added a comment - right now the builds run chrooted but I was told the user could escape the chroot jail in AbstractBuildExecutor the chroot call should be followed with a "su username" with an user that has no privileges.
Hide
Permalink
Carlos Sanchez added a comment -

Added some docs at https://svn.apache.org/repos/asf/continuum/trunk/continuum-docs/src/site/apt/administrator_guides/chroot.apt

Show
Carlos Sanchez added a comment - Added some docs at https://svn.apache.org/repos/asf/continuum/trunk/continuum-docs/src/site/apt/administrator_guides/chroot.apt
Hide
Permalink
Brett Porter added a comment -

should this be closed Carlos?

Show
Brett Porter added a comment - should this be closed Carlos?
Hide
Permalink
Emmanuel Venisse added a comment -

ping

Show
Emmanuel Venisse added a comment - ping
Hide
Permalink
Carlos Sanchez added a comment -

i wouldn't say it's done because the security of the jail is not really enforced. If someone wants to pick up the work where I left it it'd be welcome

Show
Carlos Sanchez added a comment - i wouldn't say it's done because the security of the jail is not really enforced. If someone wants to pick up the work where I left it it'd be welcome

People

  • Assignee:
    Unassigned
    Reporter:
    Carlos Sanchez
Vote (0)
Watch (1)

Dates

  • Created:
    Updated: