5 ms·
It could be zero. I'm really not sure. Someone has to go through the vulns and check if they are protected or not. It probably doesn't harm security and may sto
by benmmurphy 11y ago
It could be zero. I'm really not sure. Someone has to go through the vulns and check if they are protected or not. It probably doesn't harm security and may stop some future bug but if you have limited resources to apply to security it might be worth installing grsecurity instead of this. (https://grsecurity.net/ https://grsecurity.net/) They are often boasting about how grsecurity would have stopped a vuln. So they seem to have a track record of useful mitigations.
- baghira 11y agoSelinux should block the VENOM vulnerability in Qemu: http://danwalsh.livejournal.com/71489.html http://danwalsh.livejournal.com/71489.html See also http://www.selinuxproject.org/page/SVirt http://www.selinuxproject.org/page/SVirt Keep in mind that Grsec (which is definitely underdeployed in the linux community) is compatible with LSM such as SElinx and AppArmor, so you do not have to choose (you'll take a performance hit, though).
- benmmurphy 11y agoDo you know why people prefer to use labels in SELinux to isolate different Qemu instances rather than use different UIDs? Is it just a matter of convenience?
- mjg59 11y agoIt's easy to grant a process the privilege to transition to isolated SELiniux contexts, but it's difficult to grant a process the privilege to transition to a limited range of UIDs. Doing it with SELinux also makes it easier to provide additional restrictions - there's a lot of files and device nodes that have to be a+r for normal processes, but which don't need to be available to code running in containers. Using SELinux allows you to prevent the container processes from having access to anything other than the files inside their namespace without needing to entirely refactor the permissions in the host.