Privsep: A New Security Isolation Mechanism
summary
Rootwrap proves inadequate for fine-grained checks and performance so a prototype privsep helper daemon is built into Neutron using pyroute2 and JSON serialization, dropping most privileges to a capabilities-only process and communicating over stdio; benchmarks show roughly 20x faster than invoking ip and about 400x faster than rootwrap via rootwrapd. The Oslo spec and decorator-based API exist, the daemon exits on pipe close, and migration coexists with rootwrap for gradual rollout.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:22Who am I
- 1:17The problem
- 2:13The challenge
- 2:37The basic principle
- 5:02Pseudos
- 10:28Privsep diagram
- 13:29No context
- 16:43Single line IP commands
- 17:08Python function calls
- 19:14Adding a new function
- 20:59Config
- 22:08How does it work
- 25:24Is it confusing
- 29:44Standard vs socket perilous
- 32:07Speed
- 33:14No
