1 |
Without having read a lot of systrace... I'm gonna risk and answer. |
2 |
|
3 |
On Jul 18 07:43, Toby Dickenson wrote: |
4 |
|
5 |
> I have recently adopted systrace as a "better chroot". I find it is easier to |
6 |
> set up a new service under systrace than both chroot and selinux. Unlike |
7 |
> chroot, it is easy to disable systrace briefly if you suspect the security |
8 |
> hardening may be causing a problem. |
9 |
|
10 |
I found systrace and chroot as tools for diferent porpuses, not that one |
11 |
can replace the other. By creating a chroot you are preemtively cutting |
12 |
down the amount of damage a user can do if it passes down the security |
13 |
of the application. I still need to break out of the chroot. |
14 |
|
15 |
People has the idea that chroots are imposible to break out of. I know |
16 |
that some of the guys in my LUG have succesfully (kinda like) gotten of |
17 |
of it by inserting into the broken application, enough code to create a |
18 |
device (as in mknod) and to mount that device inside the chroot. |
19 |
|
20 |
By using capabilities (go out and fetch a 2.6 kernel!), the whole |
21 |
concept of an all migthy root is obsoleted. You create a user with has |
22 |
certain capabilities to do things, and that is all. |
23 |
|
24 |
But hey, lets keep the discussion out of the thread on the dev mailing |
25 |
list. I hope that this small enlightenment/clarification won't upset |
26 |
anyone. |
27 |
|
28 |
-- |
29 |
Alvaro Figueroa |
30 |
|
31 |
|
32 |
-- |
33 |
gentoo-dev@g.o mailing list |