Using unionfs to sandbox your system?

Erlend · Guru Joined: 26 Dec 2004 Posts: 493

I've been wondering about this for a while now.

It should, in principle, be possible to use unionfs and mounting of tmpfs devices to effectively sandbox your system, so that your system on disk is read-only and writes are sent to tmpfs.

E.g

mount -t tmpfs none /mnt/tmpfs
mount -t unionfs -o dirs=/mnt/tmpfs=rw:/=ro unionfs /
(or equivalently using one of the fuse-based unionfs implementations)

The trouble is this doesn't work, I think because I'm trying to mount over an existing mount-point (/).

Has anybody here tried this? Is there a better way to do it? I seems to me like it might be better than chroot for sandboxing the system.

Thanks,

Erlend
_________________
Thunar-thumbnailers
Raw-thumbnailer
http://brainstorm.ubuntu.com/idea/6878/image/1/

gerdesj

Perhaps you should tell us what you are trying to achieve with this manoeuvre.

Sandboxes are designed to quarantine parts of a system. I suspect you will be disappointed trying to do that to the whole system.

Cheers
Jon

Erlend · Guru Joined: 26 Dec 2004 Posts: 493

Here's a better example of what I'm trying to do,

I have many parts of my system on different partitions (/tmp /home /var and so on). Now say I want to run some binary I don't trust, so I don't want it deleting my home directory (but at the same time I'd like to capture some of the changes it's making in /mnt/tmpfs).

gerdesj · Posted: Mon Feb 07, 2011 12:14 am Post subject:

OK - sorry for my flippant response, I see what you are doing. It sounds similar to the way some Live distros work on a DVD + USB stick or even purely on the USB stick.

In your example though, I'd use a VM. They are so easy to run up using libvirt. That way you have full control over what it does.

You probably want to have /tmp mounted on a tmpfs anyway as a matter of course - it gets wiped by the init scripts at shutdown anyway.

I haven't tried out unionfs yet, so will try some experiments.

EDIT: Before I start - which UnionFS are you using! There's a kernel based one, a FUSE one and AUFS at least to choose from.

Cheers
Jon

Erlend · Guru Joined: 26 Dec 2004 Posts: 493

gerdesj · Posted: Mon Feb 07, 2011 1:14 am Post subject:

You have a shed load of RAM! tmpfs will only use whatever you put in it so you don't have to permanently set aside RAM for it. Mine is currently using 224Kb and my laptop has been running for several days now.

Just pop this in fstab: