use unshare to enforce `networkAccess: false` when not running in a container
See original GitHub issueI guess users expect that networkAccess: false
can restrict tools to access network but cwltool does not.
Currently I am not sure it is really the issue because the spec only says:
If
networkAccess
is false or not specified, tools must not assume network access, except for localhost (the loopback device).
That is,
- this behavior is valid because the spec only requests tools not to assume network access but does not request platforms to restrict network access for tools
- users expect that
networkAccess: false
can restrict tools to access network, I guess - I am not sure there is a reasonable way to restrict network access if the tool is not in a container
What do you think about it?
How to reproduce
$ cwltool curl.cwl
Expected Behavior
It fails because curl
needs network but networkAccess: false
is specified.
Actual Behavior
It does not fail.
$ cwltool curl.cwl
INFO /opt/homebrew/bin/cwltool 3.1.20220830195442
INFO Resolved 'curl.cwl' to 'file:///Users/tanjo/tmp/net/curl.cwl'
INFO [job curl.cwl] /private/tmp/docker_tmpz4hne9ck$ curl \
-fsS \
https://www.commonwl.org/v1.2/index.html > /private/tmp/docker_tmpz4hne9ck/index.html
INFO [job curl.cwl] completed success
{
"out": {
"location": "file:///Users/tanjo/tmp/net/index.html",
"basename": "index.html",
"class": "File",
"checksum": "sha1$4a7d4583b995e2fb27980ddc4ce4a9e1b4ed3952",
"size": 6525,
"path": "/Users/tanjo/tmp/net/index.html"
}
}
INFO Final process status is success
Workflow Code
#!/usr/bin/env cwl-runner
requirements:
NetworkAccess:
networkAccess: false
class: CommandLineTool
cwlVersion: v1.2
baseCommand: curl
arguments:
- -fsS
- $(inputs.fsS)
inputs:
- id: fsS
type: string
default: https://www.commonwl.org/v1.2/index.html
outputs:
- id: out
type: stdout
stdout: index.html
Full Traceback
No exceptions.
Your Environment
- cwltool version:
$ cwltool --version
/opt/homebrew/bin/cwltool 3.1.20220830195442
Issue Analytics
- State:
- Created a year ago
- Reactions:1
- Comments:8 (8 by maintainers)
Top Results From Across the Web
Block network access of a process? - Unix Stack Exchange
unshare -n program ... This creates an empty network namespace for the process. That is, it is run with no network interfaces, including...
Read more >How to start external programs in "unshare" container, with ...
Created program to do this myself: https://github.com/vi/dive. Example: # umask 0000 # # Create no-network namespace # unshare -n -- dived ...
Read more >podman/troubleshooting.md at main · containers ... - GitHub
Podman: A tool for managing OCI containers and pods. ... you will not be allowed to execute containers from storage in your home...
Read more >How to debug issues with volumes mounted on rootless ...
We can use user namespaces to separate containers from different users on ... In that case, it is not running as root on...
Read more >Using volumes with rootless podman, explained - Tutorial Works
All rootless containers must be run in the same user namespace. If they are not, some things (like sharing the network namespace from...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Tested both
bwrap
andunshare
, successfully failed to executeping
with both tools 😅With
bwrap
:And
unshare
:It doesn’t use unshare because I wasn’t familiar with it when I wrote that part of cwltool. I was mainly thinking about how you can enable/disable network access for Docker containers. I have no objections to using unshare, it sounds like a good idea.
Bubblewrap is also interesting, I glanced at it and it looks like you can basically create ad-hoc isolated environments where you get to decide what is shared and what isn’t?