3 ms·
Jails are a powerful tool, but they are not a security panacea. While it is not possible for a jailed process to break out on its own, there are several ways in
by phaemon 10y ago
Jails are a powerful tool, but they are not a security panacea. While it is not possible for a jailed process to break out on its own, there are several ways in which an unprivileged user outside the jail can cooperate with a privileged user inside the jail to obtain elevated privileges in the host environment.
- floatboth 10y agoEveryone says that, and that's right, but does that situation happen often? A typical "cloud" service like Heroku or Travis CI does NOT give you an unprivileged user outside the jail!
- cyphar 10y agoUnless you consider someone who managed to break into a Heroku box but doesn't have root. They spin up a Heroku instance and now you have root. That's a security flaw.