3 ms·
I see so much discussion of preventing _local_ escalation, but at this point almost all my services run in VMs/on dedicated hardware. Superuser powers don't buy
by local_crmdgeon 3y ago
I see so much discussion of preventing _local_ escalation, but at this point almost all my services run in VMs/on dedicated hardware. Superuser powers don't buy you anything extra there.
What I really would like more discussed is _network_ isolation. You don't need root to exfiltrate tons of data.
- brasic 3y agoSee this comment: https://news.ycombinator.com/item?id=35862698 https://news.ycombinator.com/item?id=35862698 If you implement socket activation and use an empty network namespace your service can be totally disconnected from any network and still handle requests (because the socket FD it listens on was inherited from systemd). This makes exfiltration much more difficult.
- PrimeMcFly 3y agoIs there any way to do that for systems without systemd, like Devuan?
- KirillPanov 3y agoSure, s6 has the same feature. Systemd just made up a fancy name ("socket activation") for it which is why people mistakenly assume you need systemd for it. https://skarnet.org/software/s6/s6-fdholderd.html https://skarnet.org/software/s6/s6-fdholderd.html https://wiki.gentoo.org/wiki/S6/File_descriptor_holder https://wiki.gentoo.org/wiki/S6/File_descriptor_holder http://www.skarnet.org/software/s6/socket-activation.html http://www.skarnet.org/software/s6/socket-activation.html
- PrimeMcFly 3y agoThanks!
- fsflover 3y ago> almost all my services run in VMs/on dedicated hardware Sounds like you could benefit from Qubes OS.