Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103820
MIME-Version: 1.0
References: <CAJd4=Ya6-vLh_Qm4vQ8phQL4OWAWJvbJABiLiS_OZUTG_jO04Q@mail.gmail.com>
 <65339914-c10a-4922-3444-c731bd2e34d1@gmail.com>
In-Reply-To: <65339914-c10a-4922-3444-c731bd2e34d1@gmail.com>
Date: Thu, 24 Jan 2019 11:38:21 +0000
Message-ID: <CAJd4=Yb2Nzxo-L6XHNoARGy_BF0jLE1Y23sQcfesP-0s7-DzCQ@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000794732058032a64d"
Subject: Re: [PHP-DEV] Exposing the linux namespaces API via pcntl_*
From: mail@pmmaga.net (=?UTF-8?Q?Pedro_Magalh=C3=A3es?=)

--000000000000794732058032a64d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 23, 2019 at 10:05 PM Rowan Collins <rowan.collins@gmail.com>
wrote:

> On 23/01/2019 21:15, Pedro Magalh=C3=A3es wrote:
> > I think it can be useful for a language to expose this functionality to
> the
> > users for that kind of purpose (ie. run a security sensitive task in
> > isolation, simulate certain conditions like no network access, etc..).
> For
> > that end, I've put forward https://github.com/php/php-src/pull/3760
> which
> > provides an implementation of `pcntl_unshare(int $flags): bool`. And I'=
m
> > looking for some feedback if anyone would oppose the introduction of th=
is
> > function (and probably `setns` next).
> Could you give an example of how this would work in the context of a PHP
> process? Would it only make sense in a CLI context, when performing some
> kind of system task?
>

Yes, I agree it makes most sense in a CLI context. Some examples I've
thought of:
- For testing frameworks it may be useful to have CLONE_NEWNET as that
should guarantee that a test is executed without any network access;
- For some processing tasks where you may want to mount a remote drive you
can use CLONE_NEWNS to ensure that the mount doesn't affect the host;
- If you are running a daemon controlling multiple child processes you
could issue a `pcntl_unshare(CLONE_NEWPID)` before launching each one of
them so that they can't refer to each other.
- Using all the flags available together with a `chroot` would already give
you a sufficiently isolated environment where you can run some service you
don't want installed on the host.

As for setns, it would allow you to join all the namespaces of a given
process. So your PHP process can join other processes you have unshared
before (or a Docker container for that matter).

Regards,
Pedro

--000000000000794732058032a64d--