diff options
| author | Nicolas Lacasse <nlacasse@google.com> | 2018-09-04 20:31:52 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-09-04 20:33:05 -0700 |
| commit | 0a9a40abcda602dc3403e2108e1348bf4e04051a (patch) | |
| tree | b03a73b32dccaea8c35f39c340b55243ed207790 /README.md | |
| parent | ad8648c6343cf2cf3e51a0f58cb053ee303f6ffb (diff) | |
runsc: Run sandbox as user nobody.
When starting a sandbox without direct file or network access, we create an
empty user namespace and run the sandbox in there. However, the root user in
that namespace is still mapped to the root user in the parent namespace.
This CL maps the "nobody" user from the parent namespace into the child
namespace, and runs the sandbox process as user "nobody" inside the new
namespace.
PiperOrigin-RevId: 211572223
Change-Id: I1b1f9b1a86c0b4e7e5ca7bc93be7d4887678bab6
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 7 |
1 files changed, 4 insertions, 3 deletions
@@ -179,14 +179,15 @@ here: `https://storage.googleapis.com/gvisor/releases/nightly/${yyyy-mm-dd}/runsc.sha512` **It is important to copy this binary to some place that is accessible to all -users**, since `runsc` executes itself as user `nobody` to avoid unnecessary -privileges. The `/usr/local/bin` directory is a good choice. +users, and make is executable to all users**, since `runsc` executes itself as +user `nobody` to avoid unnecessary privileges. The `/usr/local/bin` directory is +a good place to put the `runsc` binary. ``` wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc wget https://storage.googleapis.com/gvisor/releases/nightly/latest/runsc.sha512 sha512sum -c runsc.sha512 -chmod +x runsc +chmod a+x runsc sudo mv runsc /usr/local/bin ``` |