3 ms·
Are cgroups meant to be secure against malicious code trying to get out and install rootkits on the underlying system? AFAIK, hardware-level virtualization is.
by cbd1984 11y ago
Are cgroups meant to be secure against malicious code trying to get out and install rootkits on the underlying system?
AFAIK, hardware-level virtualization is. If code running under Xen can get out, that's considered a bug in Xen and it gets fixed, right?
OTOH, chroot is not considered to be secure. It isn't designed to be secure. It is not a security tool. Code in a chroot jail is expected to be able to leave without subverting the security mechanisms which, by and large, don't exist in the first place.
So, are cgroups Xen or chroot?
- kijiki 11y agoContainers (which are more than just cgroups) are supposed to be secure. In practice, the attack surface is much bigger for containers than VMs, so there are far more "break out of container" vulnerabilities out there than "break out of VM" vulnerabilities. Most containers are run in a VM, usually one being run for you by Amazon or Google.