3 ms·
Can you not use network namespaces on Linux to give a process its own restricted network device and then filter that traffic?
by vsareto 5y ago
Can you not use network namespaces on Linux to give a process its own restricted network device and then filter that traffic?
- Spivak 5y agoYes, and you can even have a single process with threads in multiple namespaces. But it still doesn’t solve the problem unless you magik passing all log messages to a dedicated pool of threads just for logging. The process is simply the wrong layer for this boundary, it’s too coarse and trying to hack your way into telling the OS about the parts of your program. OS security treats processes are black boxes, just like hypervisor security treats vms like black boxes. Trying to force it will be extremely clunky.
- samus 5y agoThe Linux kernel developers don't recommend using namespaces for security, but only for access control (the two are not the same!) because it's a relatively recent concept and the syscall interfaces and semantics are huge and subtle. Dedicated user accounts together with firewall rules are a better idea IMHO.