[IPython-dev] Notebook kernels + LXC

[Julian Taylor]

On 10/25/2012 04:52 AM, Jason Grout wrote:
> On 10/24/12 11:48 AM, Thomas Kluyver wrote:
>> A question on SO [1] got me thinking again about security in
>> multi-user cases. I've read recently about LXC [2], which provides
>> lightweight isolated environments for a set of processes.
>>
>> Is there mileage in an option for the notebook server to start each
>> kernel in a new LXC container? That would give OS-level limitations on
>> what a remote user can do, without the overhead of running full
>> virtual machines. I imagine this could be paired with a way to share
>> access to a particular notebook or session, so a malicious user
>> getting access can only damage files in that project. It could
>> probably also be set up so that file access is read-only.
>>
>> Of course, I may be on completely the wrong track. But the notebook is
>> clearly going to be used in cases where the 'all or nothing' access to
>> the underlying system is too coarse. Maybe this is one way to offer
>> finer-grained control.
>>
>> [1] http://stackoverflow.com/questions/13044921/prevent-user-del-files-in-ipython-notebook-environment/13053501#13053501
>> [2] http://lxc.sourceforge.net/
> 
> The wikipedia article has some interesting links, like:
> 
> http://blog.bofh.it/debian/id_413
> 
> that indicate that (at least a year ago) things were not finished enough 
> to be really secure.
> 
> Also, 
> http://en.wikipedia.org/wiki/Comparison_of_platform_virtual_machines 
> might be a good read for ways to isolate processes.
> 
> Thanks,
> 
> Jason
> 
> 
> 

you can secure lxc containers quite effectively with apparmor.
E.g. in ubuntu lxc by default installs profiles that deny all access to
/sys and other things

Attached is a very basic apparmor profile for ipython which works ok,
but I didn't have much need for it recently so its not very well tested.

To use it you must use a little startup script, an example is attached
too. You need to adapt the path of the start script in the profile
before you can use it.
Also rename the profile to the correct location of the script.
Then copy it to /etc/apparmor.d and load it with apparmor_parser -r
If you are not using the debian ipython package you likely have to make
some more changes so its allowed to read your custom installation.

The hardcoding of the start script and working directory is not very nice.
If one needs something more dynamic you could look at libvirt.
It does dynamic apparmor profile creation from templates via virt-aa-helper.
-------------- next part --------------
#!/bin/dash
#sudo apparmor_parser -r /etc/apparmor.d/home.jtaylor.prog.ipython-notebook
workdir=/tmp/ipython-notebook
mkdir -p $workdir
cd $workdir || exit 1
export HOME=$PWD
#export MPLCONFIGDIR=$PWD/.matplotlib
ipython notebook --no-browser --pylab=inline "$@"
-------------- next part --------------
# Last Modified: Thu Oct 25 19:05:48 2012
@{WORKDIR} = /tmp/ipython-notebook

#include <tunables/global>

/home/jtaylor/prog/ipython-notebook {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/consoles>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/python>



  /bin/bash rix,
  /bin/cat rix,
  /bin/cp rix,
  /bin/dash rix,
  /bin/ls mrix,
  /bin/mkdir rix,
  /bin/mv rix,
  /bin/touch rix,
  /bin/uname rix,
  /bin/which rix,
  /dev/ptmx rw,
  /etc/ r,
  /etc/lsb-release r,
  /etc/matplotlibrc r,
  /etc/mime.types r,
  /home/jtaylor/prog/ipython-notebook r,
  /proc/filesystems r,
  /proc/meminfo r,
  /sbin/ldconfig rix,
  /sbin/ldconfig.real rix,
  /sys/devices/system/cpu/ r,
  /usr/bin/env rix,
  /usr/bin/fc-list rix,
  /usr/bin/gawk rix,
  /usr/bin/ipython rix,
  /usr/bin/python* rix,
  /usr/bin/sort rix,
  /usr/share/ipython/notebook/** r,
  /usr/share/matplotlib/** r,
  /usr/share/poppler/**/ r,
  owner @{WORKDIR}/ rwl,
  owner @{WORKDIR}/** rwlk,
  owner @{WORKDIR}/.config/ipython/ r,
  owner @{WORKDIR}/.config/ipython/** rwk,

}