3 ms·
Interesting discussion: https://lwn.net/Articles/252794/ https://lwn.net/Articles/252794/ which links to here: http://web.archive.org/web/20071011110715/http
by cbd1984 11y ago
Interesting discussion:
https://lwn.net/Articles/252794/ https://lwn.net/Articles/252794/
which links to here:
http://web.archive.org/web/20071011110715/http://kerneltrap.org/Linux/Abusing_chroot http://web.archive.org/web/20071011110715/http://kerneltrap....
which further makes the point that chroot is not now and has never been a member of the "security tool" universe.
AIUI, containers are meant to be secure against processes (and, therefore, users) that want to get out, so if you care about that, use those, instead.
- geggam 11y agoroot is root. containers that run as root are no more secure than chroot.. ( see : docker )
- ithkuil 11y agois this true? I understand that the attack surface of a cgroup based container is bigger than a VM, but saying that just running processes as root in contains is not more secure than chroot begs at least for some reference.
- tyingq 11y agoI believe that "root is root" is just shorthand for... If you aren't using unprivileged containers, then the only approach you have for making the container more secure than chroot is a whack-a-mole style approach. By whack-a-mole, I mean trying to map out the attack surface, and using a hodge podge of tools to try and close them (kernel cap-drops, apparmor, se-linux, firewall rules, overlay mounts for /proc, /sys, etc). I think it's reasonable to say that the whack-a-mole approach isn't truly more secure. In the same way that having a vault door on the front of your house, next to an open window isn't any more secure than having the door wide open.