Multi-user, single UID ideas for Unison
nikp123 <[email protected]> Mon, 30 Oct 2023 23:44:28 +0100
| Newsgroups | gmane.network.unison.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi, I've recently joined here as I've become aware of this particular mailing list. I was considering whether it is in scope of the Unison project to add anything relating to isolating folders for a SSH-ran server process for the purposes of protecting other users and preventing any potential data leaks. I went into more detail in this GitHub issue (that's why I got redirected here): https://urldefense.com/v3/__https://github.com/bcpierce00/unison/issues/978__;!!IBzWLUs!XBSSGv7w5Z-JF7pewm5J_Lz-cysVciDZ6r1nyY3JRsLm0I76R90jwUhdlctK4mP5zZ7354Q-xZqg4YoUFEMWAcWxfkGBSQ$ So my use case relies on software that isn't able to authenticate and change file/directory UIDs depending on what user is authenticated such as FileBrowser (https://urldefense.com/v3/__https://github.com/filebrowser/filebrowser__;!!IBzWLUs!XBSSGv7w5Z-JF7pewm5J_Lz-cysVciDZ6r1nyY3JRsLm0I76R90jwUhdlctK4mP5zZ7354Q-xZqg4YoUFEMWAcXtmdxfyg$ ). For that reason I couldn't make Unison work with it without significant compromises (using bindfs, which has it's own issues) or risk potential data leaks (such as with Unicloud: https://urldefense.com/v3/__https://github.com/agarbato/unicloud__;!!IBzWLUs!XBSSGv7w5Z-JF7pewm5J_Lz-cysVciDZ6r1nyY3JRsLm0I76R90jwUhdlctK4mP5zZ7354Q-xZqg4YoUFEMWAcUTOb6bUQ$ ). My solution (that I have proposed) would require Unison to prevent the user from reading outside of its launch directory, effectively preventing the user from being able to leak data from other users or the server itself. Since the GitHub maintainer told me to specify if I have anyone behind me: No, I do not. This is just me. I am a student ATM and this is more of a personal request than anything. I am enjoying the fruits of the labor done here already and this is just a nicety that could be added on top of it (allows for more use-cases). But I am not asking for any *particular* solution, I'm asking if the solution proposed here sounds sane or even practical. Yes, I do understand it's niche for almost all of you, but I'd like for Unison's syncing prowess to be useful outside of the server administrator/poweruser sphere. This was just one way of achieving that (albeit impractical for most people). Any suggestions/comments or ideas are welcome, I'd just like to know what you all think about this before any action is made. And if it is considered to be in the scope of Unison, how will we go about implementing this. Maybe there even **is** a solution that doesn't require modifications to Unison itself and I'm just not aware of it? Who knows, that's why I'm posting here ;) Thanks for your attention, nikp123.