4 Running the SAGE Notebook Securely

This section is by Bobby Moretti (moretti@u.washington.edu).

Warning: This section has not been independently tested yet. Please read and use at your own risk. If you read it, please send feedback to Bobby Moretti (moretti@u.washington.edu).

If you are going to let the world use a Sage Notebook that you are serving from your computer, it is highly recommended you run it in a chroot jail. Otherwise a random user could easily delete all files that the local user running Sage has access to, and with more work could possibly hack into your computer.

This guide assumes that you want to put the chroot jail in /sage_chroot. Also, we assume you are using Debian GNU/Linux or a derivative thereof (such as Ubuntu).

First, we make our image file. To do that, we run the command

$ dd if=/dev/zero of=/sage_chroot.image bs=1024 count=xxx
where xxx is the desired image size in kilobytes. We recommend choosing xxx $ > 8000000$ .

Verify that the command actually created the correct file size, for example:

$ ls -lh
total 8.1G
-rw-r--r--   1 root root 8.0G 2006-06-09 18:18 sage_chroot.image
Now we need to make a filesystem on the image file. Assuming we want to make an ext3fs filesystem, we would type:
$ mke2fs -j sage_chroot.image
Once the filesystem has been created, we first add it to our fstab:
$ sudo vim /etc/fstab
Then we add the line
/sage_chroot.image /sage_chroot ext3 bind   0     0

(Of course, the above values should be changed to reflect the directory location and filesystem type you chose previously.) Then finally to mount it we run:

 
$ sudo mount -a

Next we make a user that will run the chroot jailed Sage. Here we call it server.

 
$ adduser server
...
...

From this point, follow the guide at

https://wiki.ubuntu.com/DebootstrapChroot
but STOP when you get to the section labeled ``Setting up a dchroot (non-root) environment''. This section assumes you want your entire system's /home visible inside the chroot. This is not what we want. However, to run something like Sage, we do want a home directory for the server process. We would like to prevent denial of service attacks from filling the entire disk.

Our solution is to simply use /sage_chroot/home/server as the home directory, mounting it to /home/server. First we copy the home directory's contents the chroot filesystem:

$ sudo cp -rpvf /home/server /sage_chroot/home/
$ sudo rm -rf /home/server/*
And again we edit the system fstab
$ vim /etc/fstab
and add the following lines:
/tmp  /sage_chroot/tmp    none    bind  0  0
/dev  /sage_chroot/dev    none    bind  0  0
/sage_chroot/home/server /home/server none bind  0  0
proc-chroot /sage_chroot/proc proc defaults  0  0
devpts-chroot /sage_chroot/dev/pts devpts defaults  0  0
Then we run
$ sudo mount -a
which will mount all the additions we made to /etc/fstab.

Now get Sage and install it to the desired subdirectory of /sage_chroot:

$ cd ~ 
$ wget http://www.sagemath.org/dist/src/sage-x.y.z.tar
$ cd /sage_chroot
$ tar xvf ~/sage-x.y.z.tar
$ mv sage-x.y.z/ sage/
$ cd sage
$ make
$ make clean

We also want to make it so only root can write to the files in the chroot environment. To do that, run

$ chmod og-w -R /sage_chroot/*
We're almost there. Switch to your server user:
$ su - server
(The - is very important. Sage will not run without a valid HOME variable). Then we run Sage from inside the jail with the dchroot command:
$ dchroot -d /path/to/sage
where /path/to/sage is the Sage path from inside the chrooted filesystem.

If all went well, you should be greeted by a Sage prompt. From here you can run the Sage notebook (or any other Sage with the peace of mind that it is sitting safely behind a chroot jail.

Keep in mind that the applications you have installed on your system will not be available for your chroot Sage to use. That is, if you have Octave or Mathematica installed, you will not be able to use them with your chroot Sage. (Note: in the case of Mathematica, this is a good thing, since it is illegal to provide free access to Mathematica over the web). If you do have extra packages you want to run with your chroot Sage, you need to install them from within the chroot environment.

See About this document... for information on suggesting changes.