4 ms·
Pretty much. There's always the option of putting it in a container (using Docker, for instance) or VM but chroot is probably the most commonly used and has the
by doomrobo 12y ago
Pretty much. There's always the option of putting it in a container (using Docker, for instance) or VM but chroot is probably the most commonly used and has the least overhead.
- ncza 12y agoDocker is not a security thing!
- doomrobo 12y agoI hear this refrain a lot but I never really understood it. Could you explain? I would personally feel much more comfortable running a process as a unique user in an fresh Ubuntu container than running it in a chroot. One needn't go far to find a huge number of chroot escape methods.
- walterbell 12y agohttps://news.ycombinator.com/item?id=8107450 https://news.ycombinator.com/item?id=8107450
- walterbell 12y agoIn this OS, are chroots enough to "withstand zero-day attacks in userspace", e.g. in combination with other hardening features?
- fleitz 12y agoYes, the lack of a network stack prevents the most common attacks, and drastically reduces the usefulness of gaining control of the system.
- unwind 12y agoI had to look up "zero-day attack", but it really meant what I thought it did, i.e. a previously unreported ("fresh") exploit (http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack). I don't understand this usage, which makes it sound as if zero-day attacks are a technical term, a category of attacks. Can anyone clarify?
- walterbell 12y agoIt's more of a business term, e.g. http://en.wikipedia.org/wiki/Vupen http://en.wikipedia.org/wiki/Vupen