4 ms·
Afaik they disable filesystem sandboxing, not process namespaces. Still better if programs can't ptrace around, although this is indeed a big issue. If someone
by bionade24 4y ago
Afaik they disable filesystem sandboxing, not process namespaces. Still better if programs can't ptrace around, although this is indeed a big issue.
If someone knows why this sandboxing is better/worse than SELinux or AppArmor access rules, can you pls elaborate? I'd really like to know.
- simon_o 4y agoI'm not comparing sandboxing against SELinux/AppArmor. It's a social problem, not a technical one. I'm comparing "app developers holding themselves accountable" to "package maintainers dish out consequences for misbehavior". I have absolutely zero trust in the former, and lots of trust in the latter.
- account42 4y agoYou don't need any fancy packaging to restrict ptrace: https://www.kernel.org/doc/Documentation/security/Yama.txt https://www.kernel.org/doc/Documentation/security/Yama.txt