3 ms·

Both the network and disk access permissions are granular, which means you can allow-write only to your logs folder, and allow net access only to your DB's addr

Both the network and disk access permissions are granular, which means you can allow-write only to your logs folder, and allow net access only to your DB's address.

regularfry 6y ago
So it's reimplemented chmod and iptables?
- tuukkah 6y ago
  Typically, chmod and iptables are not used to restrict applications. Applications are restricted by virtual machines, containers, sandboxes, AppArmor profiles, SELinux policies…
  - richthegeek 6y ago
    chmod/chown has been the de facto (if not de jure) method securing LAMP stacks for as long as I have been alive. Not that I recommend taking the advice of a LAMP stack too seriously :)
    - tuukkah 6y ago
      If the de facto method refers to "chmod 777", I wouldn't call that securing ;-) But indeed, if there is a separate user account for the application, then chmod can be used for some control to its access to files and directories.
  - regularfry 6y ago
    There's a fairly long history of giving applications their own uid to run under which puts chmod and chown in control of filesystem operations the app is allowed to perform. "Typically" maybe not, but it's hardly unusual. iptables + namespaces gives you the rest.
    - z3t4 6y ago
      + you can make a network namespace and have separate iptables just for that namespace/app, you can for example give the namespace/app a VPN connection without affecting the rest of the system. And other apps can join the namespace and communicate as if they had their own isolated network. NodeJS is also working on policies (1) which allows you to change permission to single modules or files. 1) https://nodejs.org/api/policy.html https://nodejs.org/api/policy.html
- fanf2 6y ago
  A bit more like OpenBSD pledge() and unveil()