3 ms·
That's a bit unfair since: 1. Most users won't be affected by all the exploits (you don't stuff in a VM all models of network cards, SCSI controllers, etc) 2.
by vbernat 10y ago
That's a bit unfair since:
1. Most users won't be affected by all the exploits (you don't stuff in a VM all models of network cards, SCSI controllers, etc)
2. Many deployments of QEMU (through Xen or Libvirt) are protected by AppArmor/SELinux. This would at least forbid access to /proc/self/mem but I can't say if this is enough to prevent evasion. IMO, this is likely to make the task quite harder.
- pas 10y agoTo be fair, Docker now defaults to using AppArmor and seccomp too. And the defaults seem to be not completely toothless either (I had to "disable" seccomp to get things running multiple times. For example, you can't just ptrace() in a container.)