Lix's seccomp rules still get applied when sandboxing is disabled #576

New issue

Open

opened 2024-11-15 04:09:59 +00:00 by lunaphied · 2 comments

lunaphied commented

2024-11-15 04:09:59 +00:00

Owner

Describe the bug

When under a platform without user namespacing enabled it is necessary to disable the sandbox. This may itself be a bug but regardless once this is disabled, you can still get an error to load the BPF seccomp program if you are running under WSL 1. WSL 1 is not an ideal environment to run Lix but I can confirm that it is functional if you build a Lix binary tarball without seccomp support and feed that to the Lix installer.

Steps To Reproduce

Try to install Lix using the Lix installer on WSL 1.0

./lix-installer plan linux --init none | tee meow.json
# Now edit that plan to disable the sandbox in the default config.
./lix-installer install meow.json

Receive error about loading the seccomp filter during the profile setup step.

Expected behavior

Installation to complete and function successfully like it does with my alternatively built copy of Lix.

`nix --version` output

## Describe the bug When under a platform without user namespacing enabled it is necessary to disable the sandbox. This may itself be a bug but regardless once this is disabled, you can still get an error to load the BPF seccomp program if you are running under WSL 1. WSL 1 is not an ideal environment to run Lix but I can confirm that it is functional if you build a Lix binary tarball without seccomp support and feed that to the Lix installer. ## Steps To Reproduce 1. Try to install Lix using the Lix installer on WSL 1.0 ```bash ./lix-installer plan linux --init none | tee meow.json # Now edit that plan to disable the sandbox in the default config. ./lix-installer install meow.json ``` 2. Receive error about loading the seccomp filter during the profile setup step. ## Expected behavior Installation to complete and function successfully like it does with my alternatively built copy of Lix. ## `nix --version` output <TODO>

lunaphied added the

labels

2024-11-15 04:09:59 +00:00

jade commented

2024-11-16 03:43:11 +00:00

Owner

This is one hundred percent intentional. Whether it's a good idea is another question, but the security of the daemon depends on seccomp due to the setuid stuff. Maybe that security issue should be mitigated in different ways (though this is generally likely to be a "lack of dev time" issue) but I'm pretty sure you're not the first one to complain about the seccomp.