3 ms·
I frankly don't understand what to trust when it comes to sandboxing in Linux. On the one hand, there are SUID binaries like Firejail and on the other, we have
by ayushnix 5y ago
I frankly don't understand what to trust when it comes to sandboxing in Linux.
On the one hand, there are SUID binaries like Firejail and on the other, we have bubblewrap which uses unprivileged user namespaces, also used by Podman and Docker rootless containers. However, linux-hardened disables unprivileged user namespaces by default and the Arch Wiki has warnings plastered all over the Podman page about potential security risks of using unpriv user namespaces.
- sascha_sl 5y agoI personally trust RedHat more with setting good defaults than random ArchLinux users (that also recommend firejail), considering the audience of RedHat (particularly some government agencies)
- maccolgan 5y agoSecurity by authority must be one of the worst things in 2021, perhaps they are optimizing for DevEx (or whatever) rather than security.
- formerly_proven 5y agoWell yeah, and Microsoft is the world's most experienced software company and a superscaler who really knows how to secure infrastructure well, you really can't hope to compete with their security teams, right up to the part where their images come with a garbage port of their WMI garbage containing uncountably infinite LPEs and RCEs running with uid=0.
- ayushnix 5y ago> I personally trust RedHat more with setting good defaults than random ArchLinux users (that also recommend firejail) You speak as if these "random Arch Linux users" have written their opinions on the wiki rather than reasonable conclusions based on how unprivileged user namespaces have been a source security vulnerabilities in the past and is still seen as a security risk. Maybe try not to let your bias get in the way?