[task #15701] Sandboxing the execution of the project

[Mohammadreza Khellat]

URL:
  <https://savannah.nongnu.org/task/?15701>

                 Summary: Sandboxing the execution of the project
                 Project: Reproducible paper template
            Submitted by: mkhellat
            Submitted on: Sun 21 Jun 2020 05:52:48 AM UTC
         Should Start On: Sun 21 Jun 2020 12:00:00 AM UTC
   Should be Finished on: Tue 21 Jul 2020 12:00:00 AM UTC
                Category: Software
                Priority: 5 - Normal
                  Status: In Progress
                 Privacy: Public
        Percent Complete: 0%
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
                  Effort: 0.00

    _______________________________________________________

Details:

In parallel to the security-oriented/security-related discussions in 
* https://savannah.nongnu.org/task/?15694
* https://savannah.nongnu.org/task/?15696
* https://savannah.nongnu.org/task/?15389
* https://savannah.nongnu.org/task/?15686
I am opening this task to discuss the implementation of an
effective/simple/platform-independent sandboxed environment for the execution
of Maneage project scripts. 

== OBJECTIVE ==
As a first step, we might try limiting filesystem access of Maneage project
scripts to their _parent directory_ while forbidding their access to specific
locations/files (such as all the hidden files and directories inside *$HOME*)
even if the Maneage project scripts parent directory contains such locations.


== MOTIVATION ==
As a scientific research project management/workflow pipeline, Maneage has
been designed with the purpose of providing transparency and clarity to the
workflow of scientific projects branched from it. This is achieved by writing
scripts and taking advantage of Make-files to create the relevant workflow.
This means that one would gain full visibility to data lineage and workflow of
the Maneage project _by going through the project scripts and MakeFiles_.
  
It is true that no Maneage project cannot NOT PROVIDE these scripts and
MakeFiles, however, in practice a thorough review of scripts and the MakeFiles
could not be that easy. 

It is going to be easy to miss things specifically when an inexperienced
Maneage project audience is trying to first test and then to understand
another person's research workflow for his own sake. The story is different
when someone wants to create his own Maneage project. 

After two to three Maneage projects, that person would surf through the
scripts and the MakeFiles very quickly and would not even have the urge to run
the scripts to understand the workflow. When clarity is achieved regarding the
workflow, to check the results or to play with the workflow, s/he might find
it necessary to run/modify the project.

Long story short, It is not practical to fully transfer the responsibility of
reviewing Maneage branched projects codes to either the audience or the
Maneage developers.




    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/task/?15701>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/