9

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils to manage LXC containers. It'll have a queue of waiting programs and a Java wrapper will maintain a fixed number (pool) of LXC containers, assigning each program one (unused) container.

Each container should be secured with SELinux to protect the host system.

My question is: Is it a good idea to create such a mechanism for a sandbox environment, or are there any better fitting solution to this problem? It should be light and secure against student creativity.

|improve this question
6

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN.

If it's about performance or hardware requirements then ok - you can try with LXC, but there are some rules You should follow:

  • libvirt ensures strict confinement of containers when using SELinux (thanks to LXC_driver) - not sure though if it's only RHEL/Centos/Fedora case (I don't use Ubuntu/Debian that much) https://www.redhat.com/archives/libvir-list/2012-January/msg01006.html - so going with SELinux is a good idea (in my opinion it's "must have" in such circumstances)
  • Set strict cgroups rules so Your guests doesn't make Your host freeze or affect other containers
  • I'd rather go with LVM based containers - it's always one more layer of "security"
  • Think about network solution and architecture. Do those containers have to communicate with each other?

Start with reading this - it's quite old, but still - there's much knowledge there. And also - meet user namespaces

And after all of that think again - do you really have that much time to play with LXC security? KVM is just so much simpler...

|improve this answer
  • First of all, thanks for answer. I choose LXC because I need something light, and it will run inside KVM. It is possible to run KVM inside KVM? – eXPi Oct 7 '13 at 8:09
1

For running untrusted programs Linux namespaces is still the best solution. It is easier to set up than KVM, and it requires less resources. You can try LXC, however LXC was build as a more generic sandbox for running full Linux distribution images. Two other Linux namespaces sandboxes come to mind:

  • Google Chrome sandbox, distributed currently with Google Chrome/Chromium
  • Firejail, a security sandbox built for running Mozilla Firerfox and any other GUI program.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.