Feature: Isolating the algorithm that the Agent runs from the rest of the kernel

[SammyOina]

Is your feature request related to a problem? Please describe.

No

Describe the feature you are requesting, as well as the possible use case(s) for it.

Isolating the algorithm that the Agent runs from the rest of the kernel

Indicate the importance of this feature to you.

Must-have

Anything else?

No response

[dborovcanin]

@danko-miladinovic Please open a drat PR for this one.

[drasko]

As an inspiration, we can take a look at VerneMQ docker start script, and see how we can set the user with the correct UID and permissions.

This can probably be done even with Buildroot, during the rootfs building phase (or maybe with post-build hook).

[danko-miladinovic]

In order to isolate the algorithm, we have several options:

1. Create a new user without sudo privileges and make the Agent run the algorithm as that user. This way the application will not be able to access the log files and it will not be able to kill the Agent (for example, for the purpose off replacing the Agent).
2. Linux Namespaces or similar tools that use Linux Namespaces. This way we can create sandbox environments to execute the algorithm. Some of the tools that use Linux Namespaces for isolation are:

• nsjail
• Bubblewrap
• Firejail
• Docker - this might be too much.

3. Use Wasm. This option is interesting because it isolates the runtime environment and also gives users options to use different programing languages for their applications. The problem here is that we cannot have files.
4. AppArmor or similar modules - Linux security module used to confine individual programs to a set of rules. This can be used in combination with the first method.

If I understood the VerneMQ docker Dockfile and start script, VerneMQ creates a new user and runs the init script as that new user. The user does not have sudo privileges.

[drasko]

Probably try with namespaces initially, but I would like Docker and Wasm to be explored as well.

[dborovcanin]

What's the status here? @danko-miladinovic

[danko-miladinovic]

What's the status here? @danko-miladinovic

There is a problem with pivot_root operation. This operation is needed to create an isolated Linux namespace process. This was intended to be used with static executables.

This is an alternative to docker, but if we move to docker this is not needed.

[dborovcanin]

Let's put this on hold until we decide what to use to run computation (executable, docker or something else).

[drasko]

We agreed to enable first Python with requirements.txt, and then after that Docker container.

[drasko]

This is probably duplicate of Wasm and Docker ones, right? If yes - please close it with the reference.