3 ms·

> You can break out of a jail if there is a local exploit that gives kernel code execution as non root. Well, this has always been true of any sandbox or virtu

by duaneb 12y ago

> You can break out of a jail if there is a local exploit that gives kernel code execution as non root. Well, this has always been true of any sandbox or virtual machine. > But this bug is to do with the fact that Linux just has a lot more complex kernel functionality than the BSDs do. Also probably true. The linux kernel was not built to be namespaced, unfortunately, so bolting no namespacing will have edge cases that are not covered. I would not recommend anyone use linux containerization for production environments for some years.

nl 12y ago
> You can break out of a jail if there is a local exploit that gives kernel code execution as non root. Well, this has always been true of any sandbox or virtual machine. That's not true for Virtual Machines. I would not recommend anyone use linux containerization for production environments for some years. Too bad people have been doing it for years - successfully - already. For example, most PAAS products use linux containers for isolation and as a security layer. OpenVZ (ie, early version of Linux containers) has been used in production hosting environments to give people root shell access for just as long.
- krakensden 12y ago
  > > You can break out of a jail if there is a local exploit that gives kernel code execution as non root. > That's not true for Virtual Machines. That's certainly an opinion: http://www.ubuntu.com/usn/usn-2342-1/ http://www.ubuntu.com/usn/usn-2342-1/ > It was discovered that QEMU incorrectly handled certain PCIe bus hotplug operations. A malicious guest could use this issue to crash the QEMU host, resulting in a denial of service Most virtualization servers are great big chunks of C and C++ running as root with a bunch of crazy optimizations for benchmarks. They get some help from the ISA, but... stuff happens.
- duaneb 12y ago
  Are you kidding? Virtual machines have been exploitable for as long as they've existed. A quick google turns up this: http://www.eweek.com/c/a/Security/VUPEN-Exploit-Enables-Virtual-Machine-Escape-107884/ http://www.eweek.com/c/a/Security/VUPEN-Exploit-Enables-Virt... I'm not arguing that people haven't successfully run in production, but doing so and assuming you won't be hit with a zero-day exploit is just naive.

by duaneb 12y ago

nl 12y ago

> You can break out of a jail if there is a local exploit that gives kernel code execution as non root. Well, this has always been true of any sandbox or virtual machine. That's not true for Virtual Machines. I would not recommend anyone use linux containerization for production environments for some years. Too bad people have been doing it for years - successfully - already. For example, most PAAS products use linux containers for isolation and as a security layer. OpenVZ (ie, early version of Linux containers) has been used in production hosting environments to give people root shell access for just as long.

krakensden 12y ago
> > You can break out of a jail if there is a local exploit that gives kernel code execution as non root. > That's not true for Virtual Machines. That's certainly an opinion: http://www.ubuntu.com/usn/usn-2342-1/ http://www.ubuntu.com/usn/usn-2342-1/ > It was discovered that QEMU incorrectly handled certain PCIe bus hotplug operations. A malicious guest could use this issue to crash the QEMU host, resulting in a denial of service Most virtualization servers are great big chunks of C and C++ running as root with a bunch of crazy optimizations for benchmarks. They get some help from the ISA, but... stuff happens.
duaneb 12y ago
Are you kidding? Virtual machines have been exploitable for as long as they've existed. A quick google turns up this: http://www.eweek.com/c/a/Security/VUPEN-Exploit-Enables-Virtual-Machine-Escape-107884/ http://www.eweek.com/c/a/Security/VUPEN-Exploit-Enables-Virt... I'm not arguing that people haven't successfully run in production, but doing so and assuming you won't be hit with a zero-day exploit is just naive.