On Thu, Aug 11, 2016 at 1:48 PM, Holger Scherer <hs@xxxxxxx> wrote:
Maybe there should be some documentation project to clearly define
which kind of software (e.g. node.js python php etc) can make good
use of a chroot environment, and others which do not need this.
I don't really understand "making good use" of chroot, from a software
point of view. At least not application-level software. I see it as
almost purely an administrative tool. Maybe you mean you'd like to
know what kind of software can be run effectively within a chroot
environment? In principle, I think *anything* that lives purely in
PASE is a candidate for running inside a chroot environment. But I
don't know in practice how well that works yet. I think we're all
still in the process of discovering that. :)
On a shared public system like PUB400 it is always a good idea to
separate users which is mainly done on object security, but some
OSS software depends on other methods - also they depend on the
knowledge of admin and user ;-)
So much does depend on the knowledge of the admin and user!
Now, I don't know how you have set up pub400.com or how Aaron has set
up Litmis Spaces, but my impression is that every Litmis Space lives
in its own chroot container. The Python that I am using in my Litmis
Space looks as though it is the "system" Python, but if I am right, it
really is just the Python that is in one container, so if I were to
modify it somehow (for example, install some Python packages into the
site-packages directory), no one else's Python would be affected. We
would each have our own virtual system.
Conversely, it seems to me that all the accounts on pub400.com see the
same root file system (no separate containers). If I'm right, the
"system" Python for me really is the system Python for everyone. So if
I were to install a package for that Python, then everyone would be
able to use it. It looks like I can't do this, because I just tried.
;) (I figured that if I succeeded, then I could also uninstall the
package.) Having restrictive permissions set up so that "regular"
users like myself can't (easily) screw up the system makes absolute
sense if we all have to share the same installation.
Note that for Python, it's not especially important for me to be able
to install packages into the system Python. I can easily create my own
virtual Python environments using venv (and I have already done this
on pub400.com). This is basically the same concept as chroot, except
just for Python instead of the whole root file system. I would guess
that other open-source languages have similar facilities.
PUB400.COM currently has 1300 users (with 30-40 new users a day),
so i am not sure what would be the impact to the system if
a full chroot environment would be added for each user automatically.
I don't know either. Maybe it would be heavy, maybe it would not. You
have a lot of users, but how many simultaneously use the system? If
it's only a small fraction of total users, then probably all you
really need is sufficient disk space.
John Y.
midrange.com
