4 ms·
We wouldn't have to rely on security by hypervisor if linux had proper security measures, sandboxing and access controls OOTB. Qubes is still far from good alth
by udev4096 2y ago
We wouldn't have to rely on security by hypervisor if linux had proper security measures, sandboxing and access controls OOTB. Qubes is still far from good although it's slowly getting there
- dijit 2y agowhat are you talking about? Of course we do? We totally forgotten about mandatory access control systems? AppArmor, SELinux? problem isn’t that they don’t exist; it’s that nobody knows how to use them properly. You can even minimise the kernel attack surface these days with utilities like gVisor. people just understand virtual machines easier. It’s easy to understand the isolation it gives and easier to reduce unnecessary potential attack vectors by having minimal images that don’t contain more than necessary.
- udev4096 2y ago"OOTB" is the term you missed. Obviously, there are kernel features such as seccomp and other LSM but it's not easy to properly configure. Even if you do, it usually comes in your way of getting stuff done. Regarding gvisor, it's solid and I've been intending to use it on k3s
- i_love_retros 2y agoAm I wrong in thinking that Ubuntu has apparmor configured by default?
- mmh0000 2y agoYes, Ubuntu has AppArmor and Fedora (RHEL, et. al.) have SELinux. The problem is that both systems are quite difficult to use properly. The out-of-the-box configuration is good for a base increase in overall system security against common threats. However, if you want the real isolation benefits that these MAC systems are capable of providing, you'll need a full-time security team with years of training to manage your personal desktop.