2 ms·
In all fairness, you don't run any modern UNIX server without giving each sensitive server its own user, which effectively sandboxes it (not quite the same as c
by lazaroclapp 11y ago
In all fairness, you don't run any modern UNIX server without giving each sensitive server its own user, which effectively sandboxes it (not quite the same as chroot/containers/VMs, but still). Of course, desktop UNIX/Linux tends to have many important processes running as the same user, but that falls under "Desktop OSes are generally pretty bad".
- rdl 11y agoEveryone sane runs sensitive systems "system high" now, where there's a machine dedicated per task. User/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly. You can use VMs for some of that, but that's the limit on sharing (and that's if you trust your hypervisor to be a separation kernel thing; reasonable for many people. Not for others.) Docker/containers isn't enough. Users aren't enough. Processes aren't enough.