From a14eb926568699f7fa07dec3b61c9e4364bebe6e Mon Sep 17 00:00:00 2001 From: Paul Fitzpatrick Date: Wed, 6 Apr 2022 15:52:24 -0400 Subject: [PATCH 1/2] back off from making gvisor sandboxing default in docker image (#178) It looks like making gvisor sandboxing the default in our docker image is causing people trouble, so this backs off from that change. We retain gvisor's runsc executable in the image so that turning on sandboxing is just an environment variable setting away. Lack of sandboxing is not good for users opening untrusted documents, so it would be good to be aggressive about turning it on, or communicating about it, so there's follow-up work needed. In the meantime I've updated the documentation about it somewhat. See https://github.com/gristlabs/grist-core/issues/177 --- Dockerfile | 10 +++++++++- README.md | 24 +++++++++++++++++++++++- 2 files changed, 32 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index dbe18aae..cf479c83 100644 --- a/Dockerfile +++ b/Dockerfile @@ -94,6 +94,14 @@ ADD plugins plugins # started as: # docker run -p 8484:8484 -it # Variables will need to be overridden for other setups. +# +# GRIST_SANDBOX_FLAVOR is set to unsandboxed by default, because it +# appears that the services people use to run docker containers have +# a wide variety of security settings and the functionality needed for +# sandboxing may not be possible in every case. For default docker +# settings, you can get sandboxing as follows: +# docker run --env GRIST_SANDBOX_FLAVOR=gvisor -p 8484:8484 -it +# ENV \ PYTHON_VERSION_ON_CREATION=3 \ GRIST_ORG_IN_PATH=true \ @@ -104,7 +112,7 @@ ENV \ GRIST_INST_DIR=/persist \ GRIST_SESSION_COOKIE=grist_core \ GVISOR_FLAGS="-unprivileged -ignore-cgroups" \ - GRIST_SANDBOX_FLAVOR=gvisor \ + GRIST_SANDBOX_FLAVOR=unsandboxed \ TYPEORM_DATABASE=/persist/home.sqlite3 EXPOSE 8484 diff --git a/README.md b/README.md index 27e711e8..fd7735f2 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,11 @@ Here are some specific feature highlights of Grist: - Control access based on cell values and user attributes. * Can be self-maintained. - Useful for intranet operation and specific compliance requirements. + * Sandboxing options for untrusted documents. + - On Linux or with docker, you can enable + [gVisor](https://github.com/google/gvisor) sandboxing at the individual + document level. + - On OSX, you can use native sandboxing. If you are curious about where Grist is going heading, see [our roadmap](https://github.com/gristlabs/grist-core/projects/1), drop a @@ -62,7 +67,7 @@ There are docker images set up for individual use, or (with some configuration) for self-hosting. Grist Labs offers a hosted service at [docs.getgrist.com](https://docs.getgrist.com). -To run Grist running on your computer with [Docker](https://www.docker.com/get-started), do: +To get Grist running on your computer with [Docker](https://www.docker.com/get-started), do: ```sh docker pull gristlabs/grist @@ -88,6 +93,10 @@ port mapping: docker run --env PORT=9999 -p 9999:9999 -v $PWD/persist:/persist -it gristlabs/grist ``` +To enable gVisor sandboxing, set `--env GRIST_SANDBOX_FLAVOR=gvisor`. +This should work with default docker settings, but may not work in all +environments. + ## Building from source To build Grist from source, follow these steps: @@ -98,6 +107,19 @@ To build Grist from source, follow these steps: yarn start # Grist will be available at http://localhost:8484/ +Grist formulas in documents will be run using Python executed directly on your +machine. You can configure sandboxing using a `GRIST_SANDBOX_FLAVOR` +environment variable. + + * On OSX, `export GRIST_SANDBOX_FLAVOR=macSandboxExec` + uses the native `sandbox-exec` command for sandboxing. + * On Linux with [gVisor's runsc](https://github.com/google/gvisor) + installed, `export GRIST_SANDBOX_FLAVOR=gvisor` is an option. + +These sandboxing methods have been written for our own use at Grist Labs and +may need tweaking to work in your own environment - pull requests +very welcome here! + ## Logins Like git, Grist has features to track document revision history. So for full operation, From 8367219cf152051ae58014391525e59512acf6fc Mon Sep 17 00:00:00 2001 From: Paul Fitzpatrick Date: Thu, 7 Apr 2022 10:03:28 -0400 Subject: [PATCH 2/2] v0.7.8 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index dc7b92c1..5a3bbaf1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "grist-core", - "version": "0.7.7", + "version": "0.7.8", "license": "Apache-2.0", "description": "Grist is the evolution of spreadsheets", "homepage": "https://github.com/gristlabs/grist-core",