{"action":"created","issue":{"url":"https://api.github.com/repos/ev3dev/brickstrap/issues/14","labels_url":"https://api.github.com/repos/ev3dev/brickstrap/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/ev3dev/brickstrap/issues/14/comments","events_url":"https://api.github.com/repos/ev3dev/brickstrap/issues/14/events","html_url":"https://github.com/ev3dev/brickstrap/pull/14","id":123902344,"number":14,"title":"Introduce unshare-harder variant of brickstrap.sh.","user":{"login":"cmacq2","id":13215950,"avatar_url":"https://avatars.githubusercontent.com/u/13215950?v=3","gravatar_id":"","url":"https://api.github.com/users/cmacq2","html_url":"https://github.com/cmacq2","followers_url":"https://api.github.com/users/cmacq2/followers","following_url":"https://api.github.com/users/cmacq2/following{/other_user}","gists_url":"https://api.github.com/users/cmacq2/gists{/gist_id}","starred_url":"https://api.github.com/users/cmacq2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmacq2/subscriptions","organizations_url":"https://api.github.com/users/cmacq2/orgs","repos_url":"https://api.github.com/users/cmacq2/repos","events_url":"https://api.github.com/users/cmacq2/events{/privacy}","received_events_url":"https://api.github.com/users/cmacq2/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-26T00:47:31Z","updated_at":"2015-12-26T18:35:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ev3dev/brickstrap/pulls/14","html_url":"https://github.com/ev3dev/brickstrap/pull/14","diff_url":"https://github.com/ev3dev/brickstrap/pull/14.diff","patch_url":"https://github.com/ev3dev/brickstrap/pull/14.patch"},"body":"This is Debian specific fallback version which will first prod the kernel into allowing ordinary users to unshare, as this is a necessary for user-unshare.pl on recent-ish Debian.\r\nAny changes to original kernel settings are reverted on exit.\r\nThis workaround avoids having to run the entire brickstrap with sudo/su or to change the default unshare policy permanently.\r\nOnly the initial prodding and reverting need sudo/su privileges.\r\n\r\nBy request the unshare-harder variant was split off into a PR of its own, from #12\r\nContinuing the comment thread:\r\n * The purpose of the unshare-harder variant is to avoid having to run the actual brickstrap command with elevated privileges, essentially extracting the privileged operations into well-defined, limited commands that do not touch files in the user's home directory.\r\n * This avoids running brickstrap as root even if unshare() is disabled for ordinary users by default on Debian. Running brickstrap with sudo or su would be quite a bad idea and rather ignore the entire raison d' être of brickstrap.\r\n * Using `sudo su` means that the user can simply input their 'normal' password instead of the password for root. This may be useful in scenarios where root isn't setup for login shells (as with e.g. Ubuntu by default) or they lack the root password. The downside is that the script requires sudo (in addition to su) which you may or may not find a gratuitous dep.  It's possible to make the exact choice (`sudo su` or plain `su`) configurable using a environment variable, of course... but even then the best default needs to be agreed upon."},"comment":{"url":"https://api.github.com/repos/ev3dev/brickstrap/issues/comments/167353344","html_url":"https://github.com/ev3dev/brickstrap/pull/14#issuecomment-167353344","issue_url":"https://api.github.com/repos/ev3dev/brickstrap/issues/14","id":167353344,"user":{"login":"dlech","id":963645,"avatar_url":"https://avatars.githubusercontent.com/u/963645?v=3","gravatar_id":"","url":"https://api.github.com/users/dlech","html_url":"https://github.com/dlech","followers_url":"https://api.github.com/users/dlech/followers","following_url":"https://api.github.com/users/dlech/following{/other_user}","gists_url":"https://api.github.com/users/dlech/gists{/gist_id}","starred_url":"https://api.github.com/users/dlech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dlech/subscriptions","organizations_url":"https://api.github.com/users/dlech/orgs","repos_url":"https://api.github.com/users/dlech/repos","events_url":"https://api.github.com/users/dlech/events{/privacy}","received_events_url":"https://api.github.com/users/dlech/received_events","type":"User","site_admin":false},"created_at":"2015-12-26T18:35:17Z","updated_at":"2015-12-26T18:35:17Z","body":"I appreciate the idea here, but I'm still not keen on including this.\r\n\r\nI've added a check for this in `brickstrap.sh` and added a bit to the readme in https://github.com/ev3dev/brickstrap/commit/f5b9bf0621b1aab8e66086c3c671428cbb12f0de.\r\n\r\nThe two things I don't care for are:\r\n\r\n1. Since brickstrap is generally long running, it is highly likely that not only will you have to enter your password when it starts, you will also have to enter your password again when it ends, so if you run brickstrap more than once, this is not really saving you time vs. manually running `sudo sysctl -w kernel.unprivileged_userns_clone=1` and `sudo sysctl -w kernel.unprivileged_userns_clone=0` (and you can copy and paste from the brickstrap error message if you forget what the command is).\r\n2. It hides what is actually be done from the user. Since this is a security issue, the user should know exactly what setting he/she is changing."}}