subuser: run Linux programs with selectively restricted permissions

栏目: IT技术 · 发布时间: 4年前

内容简介:As free software developers we like to share. We surf the web and discover new code. We are eager to try it out. We live out an orgy of love and trust, unafraid that some code we cloned from Git might be faulty or malicious. We live in the 60s, carefree hi

Subuser - Securing the Linux desktop with Docker

subuser: run Linux programs with selectively restricted permissions

Visit us at subuser.org

As free software developers we like to share. We surf the web and discover new code. We are eager to try it out. We live out an orgy of love and trust, unafraid that some code we cloned from Git might be faulty or malicious. We live in the 60s, carefree hippies.

This is utopia.

But sharing code isn't safe. Every time we try out some stranger's script, we put ourselves at risk. Despite the occasional claim that Linux is a secure operating system, haphazardly sharing programs is NOT secure.

Furthermore, the fragmentation of the Linux desktop means that packaging work is needlessly repeated. Programs that build and run on Fedora must be repackaged for Ubuntu.

Subuser with Docker attacks both problems simultaneously. Docker provides an isolated and consistent environment for your programs to run in. Subuser gives your desktop programs access to the resources they need in order to function normally.

Subuser turns Docker containers into normal Linux programs:

Right now I'm editing this file in vim . vim is not installed on my computer though. It is installed in a docker container. However, in order to edit this file, all I had to do was type:

$ vim README.md

Subuser turns a docker container into a normal program. But this program is not fully privileged. It can only access the directory from which it was called, not my entire home dir . Each subuser is assigned a specific set of permissions, just like in Android. You can see an example permissions.json file bellow.

{
  "description"                : "A web browser."
  ,"maintainer"                : "Timothy Hobbs <timothyhobbs (at) seznam dot cz>"
  ,"executable"                : "/usr/bin/firefox"
  ,"user-dirs"                 : [ "Downloads"]
  ,"gui"                       : {"clipboard":true,"cursors":true}
  ,"sound-card"                : true
  ,"allow-network-access"      : true
}

For a list of all permissions supported by subuser, please see the subuser standard .

Installation

System Requirements

  • Docker 1.3 or higher
  • Python >= 3
  • Git
  • X11 and the xauth utility (You almost certainly have this)
  • sudo (if you don't want to become a member of the docker group)

OS Requirements

  • Linux: Everything supported
  • OSX with docker for desktop: Limited support
    • inherit-timezone is ignored
    • xpra (graphical apps) doesnt work
    • Probaly other issues

Install with pip3: Stable version

  1. Add yourself to the sudo group (or the docker group).
$ sudo nano /etc/group

Find sudo and add your username to the end of the line.

  1. Install subuser from pip3.

$ sudo pip3 install subuser

  1. Add ~/.subuser/bin to your path by adding the line PATH=$HOME/.subuser/bin:$PATH to the end of your .bashrc file.
  2. Log out and then back in again.
  3. Done!

Install from git: Development version

  1. Add yourself to the sudo group (this is not necesary if you are already a member of the docker group).
  2. Download the subuser repository
$ cd
$ git clone https://github.com/subuser-security/subuser
  1. Add subuser/logic and ~/.subuser/bin to your path by adding the line PATH=$HOME/subuser/logic:$HOME/.subuser/bin:$PATH to the end of your .bashrc file.

Note

You will need to change the path to subuser/logic to refer to the location to which you downloaded subuser.

  1. Log out and then back in again.
  2. Done!

To learn more and read the full manual please visit subuser.org


以上所述就是小编给大家介绍的《subuser: run Linux programs with selectively restricted permissions》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

参数化建筑设计

参数化建筑设计

高云河、白云生 / 华中科技大学出版社 / 2016-8-1 / 69.80

《参数化建筑设计》以案例的形式讲解参数化建筑设计的具体方法,其中包含犀牛(Rhino)和Grasshopper的应用。本书不单单是一本计算机软件教材,书中教会读者的是参数化建筑设计的思路,希望通过完成一个个案例使读者融会贯通,在今后的设计工作中能够熟练使用,辅助自身完成建筑设计。全书共有10个案例,循序渐进,由浅入深,几乎涵盖了参数化建筑设计所要使用的所有功能和方法。一起来看看 《参数化建筑设计》 这本书的介绍吧!

JS 压缩/解压工具
JS 压缩/解压工具

在线压缩/解压 JS 代码

MD5 加密
MD5 加密

MD5 加密工具

SHA 加密
SHA 加密

SHA 加密工具