4 ms·
TL;DR: Pay attention to arcane details or don't use containers for security related stuff. Also grsecurity. Honest question: Are illumos zones or FreeBSD jails
by nisa 11y ago
TL;DR: Pay attention to arcane details or don't use containers for security related stuff. Also grsecurity.
Honest question: Are illumos zones or FreeBSD jails better designed or is just nobody looking for kernel bugs there? From a usability perspective both win (IMHO) against this Linux mess.
This document is really great through.
- dyn 11y agoAuthor of the paper here. Thanks. As for Jails and Illumos, I would be willing to bet it's people not looking, but I haven't looked, so I can't really say. I agree it's kind of a mess, but it's getting better!
- ktzar 11y agoIs there a chance a repo with a .md version or an epub can be shared? It's quite hard to read a 100+ PDF document without printing it.
- voidz 11y agoI'd like this too. An .epub would be nice for e-ink readers like Pocketbook, Kobo, and Kindle.
- voidz 11y agoIs it possible to get notified (via email) when this paper has been updated?
- Annatar 11y agoYou would lose that bet so fast your head would be both spinning and smoking: zones have been hardened and worked on for enterprises since 2006, and in ten years have had three known vulnerabilities, the last two having already been fixed in illumos (and not exploitable without being able to be explicitly run by a user inside of a hypervisor). As Bryan Catrill has said in one of his talks: "we walked the trail if tears since our customers were very large companies; if they had a problem, we had a problem!" The illumos and smartos mailing lists are hyperactive, with bugs being fixed, and new functionality added, which even Oracle Solaris doesn't have -- just subscribe to those two mailing lists and see for yourself. I warn you in advance: be prepared to be buried under the vortex of e-mails.
- droopybuns 11y agoInvoking the Trail of Tears to describe development hardship is, I think, inappropriate. Wish that guy would be a bit more cautious with his metaphors.
- solarengineer 11y agoGiven that you have affixed your name and have now heard of Jails and of Illumos (and SmartOS), you may want to consider amending your paper to state as such. Also, Illumos was forked off Solaris, and I'm sure that you know of Solaris' security. Looking forward to your amendment and revised paper.
- X86BSD 11y agoMy username gives away my bias however, I think you will find Jails and the work Joyent/Illumos have done with containers, to be actually engineered secure from the getgo. Linux, well, I think it's obvious the route Linux took. And none of their "container" solutions were ever designed with security as the starting point. It was always bolted on as an after thought. Trust me people have been looking for kernel bugs in FreeBSD to exploit jails since it was created. The record their speaks for itself. It's not a lack of eyeballs.
- phaemon 11y agoJails are a powerful tool, but they are not a security panacea. While it is not possible for a jailed process to break out on its own, there are several ways in which an unprivileged user outside the jail can cooperate with a privileged user inside the jail to obtain elevated privileges in the host environment.
- floatboth 11y agoEveryone says that, and that's right, but does that situation happen often? A typical "cloud" service like Heroku or Travis CI does NOT give you an unprivileged user outside the jail!
- cyphar 11y agoUnless you consider someone who managed to break into a Heroku box but doesn't have root. They spin up a Heroku instance and now you have root. That's a security flaw.