6 ms·
By running the process under a different filesystem namespace than "normal" processes, you're effectively sandboxing it.
by mgaunard 3y ago
By running the process under a different filesystem namespace than "normal" processes, you're effectively sandboxing it.
- nyrikki 3y agoNot when I can read the root filesytem if mknod privilege isn't dropped, update firmware on the EFI partition, load kernel modules in the host namespace etc.... But it is really about the order namespaces start with almost no isolation and you add whatever you want. Sandboxes and Jails tend to start more restricted by default. As an example here is an older step by step example of the above. Note how disabling privileged containers at the docker server layer is still not possible as they decided user namespaces were their solution. https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities/44100971#44100971 https://stackoverflow.com/questions/36425230/privileged-cont...
- kiitos 3y agoThe line is fuzzy. Containers are processes, but sandboxing requires more than just FS/chroot isolation.
- nyrikki 3y agoYes it is fuzzy, the point being is that most people assume sandboxes are some form of default deny. With containers, there is a responsibility for both the instantiation and the container image to ensure that isolation happens. That is why I hesitate to consider them equal as the responsibilities are different.