{"id":279,"date":"2006-06-16T23:09:14","date_gmt":"2006-06-17T06:09:14","guid":{"rendered":"http:\/\/multimedia.cx\/eggs\/?p=279"},"modified":"2008-01-14T12:55:38","modified_gmt":"2008-01-14T20:55:38","slug":"secure-automated-builds","status":"publish","type":"post","link":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/","title":{"rendered":"Secure Automated Builds"},"content":{"rendered":"<p>I have a small, low-power x86 Linux box sitting on the internet. I want to use it to set up an automated build system for <a href=\"http:\/\/ffmpeg.org\/\">FFmpeg<\/a>. To what end? At the outset, I would like to validate that the entire codebase builds, with all extra modules enabled, under different gcc versions and post results to a webpage.<\/p>\n<p>The process outline is pretty straightforward. At periodic intervals:<\/p>\n<ul>\n<li>check out a fresh copy of the FFmpeg SVN tree<\/li>\n<li>&#8216;configure&#8217; with all relevant options and the desired compiler version<\/li>\n<li>&#8216;make&#8217;, log the stdout and stderr text in separate text files<\/li>\n<li>log the status report to a public website<\/li>\n<\/ul>\n<p>Pretty simple so far. Other ideas include compiling with multiple compiler versions, including cross-compilers for multiple platforms; automated regression testing; aggregated results sent to a new mailing list <em>[insert your brainstorm here]<\/em>. I&#8217;m starting small because this particular machine requires almost a half hour to complete just one FFmpeg build.<\/p>\n<p>Here is the big item I&#8217;m concerned about: How to guard against malicious script injections? Not to say that I don&#8217;t trust my FFmpeg brethren but&#8230; I can&#8217;t think of a good way to end that sentence. But think about it: When you run the configuration script and Makefile, you&#8217;re executing free-form shell commands. One of the worser-case scenarios:<\/p>\n<pre>\r\nall:\r\n    find \/ | xargs rm -rf\r\n<\/pre>\n<p>&#8220;But Mike,&#8221; I hear you exclaim, &#8220;as long as you run it as your own unprivileged user vs. root, it won&#8217;t destroy the entire system.&#8221; That&#8217;s terrific news; the easily replaced Linux base system would be safe. So what about running the build process as a heretofore non-existent user (something other than &#8216;nobody&#8217; since a standard Linux box is going to have files owned by him)? Random shell commands could still, for example, read world-readable files and transmit them offsite. What kind of files? I&#8217;m not interested in the fine details, it&#8217;s still a security hole.<\/p>\n<p>So there is the possibility of switching to the unknown user in its own chroot&#8217;d shell. Ideally, this environment would:<\/p>\n<ul>\n<li>prohibit network access (setup process gets the fresh SVN tree before entering chroot shell)<\/li>\n<li>have access to various build tools<\/li>\n<\/ul>\n<p>I guess what I&#8217;m wondering is: Have these problems already been solved? Are there open source projects that already provide good solutions to these problems? Otherwise, I already know it&#8217;s a lot of work to set up such an chroot environment (and I have no idea how to prohibit network access for a particular user).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sound software engineering practice&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[101,3],"tags":[],"class_list":["post-279","post","type-post","status-publish","format-standard","hentry","category-fate-server","category-open-source-multimedia"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Sound software engineering practice...\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Multimedia Mike\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Breaking Eggs And Making Omelettes | Topics On Multimedia Technology and Reverse Engineering\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Secure Automated Builds | Breaking Eggs And Making Omelettes\" \/>\n\t\t<meta property=\"og:description\" content=\"Sound software engineering practice...\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2006-06-17T06:09:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2008-01-14T20:55:38+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Secure Automated Builds | Breaking Eggs And Making Omelettes\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Sound software engineering practice...\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#article\",\"name\":\"Secure Automated Builds | Breaking Eggs And Making Omelettes\",\"headline\":\"Secure Automated Builds\",\"author\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/author\\\/multimedia-mike\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/#organization\"},\"datePublished\":\"2006-06-16T23:09:14-07:00\",\"dateModified\":\"2008-01-14T12:55:38-08:00\",\"inLanguage\":\"en-US\",\"commentCount\":3,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#webpage\"},\"articleSection\":\"FATE Server, Open Source Multimedia\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/multimedia.cx\\\/eggs\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/category\\\/open-source-multimedia\\\/#listItem\",\"name\":\"Open Source Multimedia\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/category\\\/open-source-multimedia\\\/#listItem\",\"position\":2,\"name\":\"Open Source Multimedia\",\"item\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/category\\\/open-source-multimedia\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#listItem\",\"name\":\"Secure Automated Builds\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#listItem\",\"position\":3,\"name\":\"Secure Automated Builds\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/category\\\/open-source-multimedia\\\/#listItem\",\"name\":\"Open Source Multimedia\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/#organization\",\"name\":\"Breaking Eggs And Making Omelettes\",\"description\":\"Topics On Multimedia Technology and Reverse Engineering\",\"url\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/author\\\/multimedia-mike\\\/#author\",\"url\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/author\\\/multimedia-mike\\\/\",\"name\":\"Multimedia Mike\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2eb93f7cada658f7986b5092062849fa255779eada3342c8f6b9a40764b95fdd?s=96&d=identicon&r=g\",\"width\":96,\"height\":96,\"caption\":\"Multimedia Mike\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#webpage\",\"url\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/\",\"name\":\"Secure Automated Builds | Breaking Eggs And Making Omelettes\",\"description\":\"Sound software engineering practice...\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/secure-automated-builds\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/author\\\/multimedia-mike\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/author\\\/multimedia-mike\\\/#author\"},\"datePublished\":\"2006-06-16T23:09:14-07:00\",\"dateModified\":\"2008-01-14T12:55:38-08:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/#website\",\"url\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/\",\"name\":\"Breaking Eggs And Making Omelettes\",\"description\":\"Topics On Multimedia Technology and Reverse Engineering\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/multimedia.cx\\\/eggs\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Secure Automated Builds | Breaking Eggs And Making Omelettes","description":"Sound software engineering practice...","canonical_url":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#article","name":"Secure Automated Builds | Breaking Eggs And Making Omelettes","headline":"Secure Automated Builds","author":{"@id":"https:\/\/multimedia.cx\/eggs\/author\/multimedia-mike\/#author"},"publisher":{"@id":"https:\/\/multimedia.cx\/eggs\/#organization"},"datePublished":"2006-06-16T23:09:14-07:00","dateModified":"2008-01-14T12:55:38-08:00","inLanguage":"en-US","commentCount":3,"mainEntityOfPage":{"@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#webpage"},"isPartOf":{"@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#webpage"},"articleSection":"FATE Server, Open Source Multimedia"},{"@type":"BreadcrumbList","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs#listItem","position":1,"name":"Home","item":"https:\/\/multimedia.cx\/eggs","nextItem":{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/#listItem","name":"Open Source Multimedia"}},{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/#listItem","position":2,"name":"Open Source Multimedia","item":"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/","nextItem":{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#listItem","name":"Secure Automated Builds"},"previousItem":{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#listItem","position":3,"name":"Secure Automated Builds","previousItem":{"@type":"ListItem","@id":"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/#listItem","name":"Open Source Multimedia"}}]},{"@type":"Organization","@id":"https:\/\/multimedia.cx\/eggs\/#organization","name":"Breaking Eggs And Making Omelettes","description":"Topics On Multimedia Technology and Reverse Engineering","url":"https:\/\/multimedia.cx\/eggs\/"},{"@type":"Person","@id":"https:\/\/multimedia.cx\/eggs\/author\/multimedia-mike\/#author","url":"https:\/\/multimedia.cx\/eggs\/author\/multimedia-mike\/","name":"Multimedia Mike","image":{"@type":"ImageObject","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/2eb93f7cada658f7986b5092062849fa255779eada3342c8f6b9a40764b95fdd?s=96&d=identicon&r=g","width":96,"height":96,"caption":"Multimedia Mike"}},{"@type":"WebPage","@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#webpage","url":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/","name":"Secure Automated Builds | Breaking Eggs And Making Omelettes","description":"Sound software engineering practice...","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/multimedia.cx\/eggs\/#website"},"breadcrumb":{"@id":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/#breadcrumblist"},"author":{"@id":"https:\/\/multimedia.cx\/eggs\/author\/multimedia-mike\/#author"},"creator":{"@id":"https:\/\/multimedia.cx\/eggs\/author\/multimedia-mike\/#author"},"datePublished":"2006-06-16T23:09:14-07:00","dateModified":"2008-01-14T12:55:38-08:00"},{"@type":"WebSite","@id":"https:\/\/multimedia.cx\/eggs\/#website","url":"https:\/\/multimedia.cx\/eggs\/","name":"Breaking Eggs And Making Omelettes","description":"Topics On Multimedia Technology and Reverse Engineering","inLanguage":"en-US","publisher":{"@id":"https:\/\/multimedia.cx\/eggs\/#organization"}}]},"og:locale":"en_US","og:site_name":"Breaking Eggs And Making Omelettes | Topics On Multimedia Technology and Reverse Engineering","og:type":"article","og:title":"Secure Automated Builds | Breaking Eggs And Making Omelettes","og:description":"Sound software engineering practice...","og:url":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/","article:published_time":"2006-06-17T06:09:14+00:00","article:modified_time":"2008-01-14T20:55:38+00:00","twitter:card":"summary","twitter:title":"Secure Automated Builds | Breaking Eggs And Making Omelettes","twitter:description":"Sound software engineering practice..."},"aioseo_meta_data":{"post_id":"279","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"location":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2020-12-31 21:50:07","updated":"2025-12-31 18:31:28","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/multimedia.cx\/eggs\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/\" title=\"Open Source Multimedia\">Open Source Multimedia<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tSecure Automated Builds\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/multimedia.cx\/eggs"},{"label":"Open Source Multimedia","link":"https:\/\/multimedia.cx\/eggs\/category\/open-source-multimedia\/"},{"label":"Secure Automated Builds","link":"https:\/\/multimedia.cx\/eggs\/secure-automated-builds\/"}],"_links":{"self":[{"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/posts\/279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/comments?post=279"}],"version-history":[{"count":0,"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/posts\/279\/revisions"}],"wp:attachment":[{"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/media?parent=279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/categories?post=279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/multimedia.cx\/eggs\/wp-json\/wp\/v2\/tags?post=279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}