lkml.org 
[lkml]   [2008]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] per-process securebits
    Quoting Andrew G. Morgan (morgan@kernel.org):
    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > Ismail D??nmez wrote:
    > | What I meant to ask was what does "per-process securebits" brings as
    > extra.
    >
    > It allows you to create a legacy free process tree. For example, a
    > chroot, or container (which Serge can obviously explain in more detail),

    (Just to give my thoughts on securebits and containers)

    A container is a set of processes which has its own private namespaces
    for all or most resources - for instance it sees only processes in its
    own pid namespace, and its first process, which is sees as pid 1, is
    known as some other pid, maybe 3459, to the rest of the system.

    We tend to talk about 'system containers' versus 'application
    containers'. A system container would be like a vserver or openvz
    instance, something which looks like a separate machine. I was
    going to say I don't imagine per-process securebits being useful
    there, but actually since a system container doesn't need to do any
    hardware setup it actually might be a much easier start for a full
    SECURE_NOROOT distro than a real machine. Heck, on a real machine init
    and a few legacy deamons could run in the init namespace, while users
    log in and apache etc run in a SECURE_NOROOT container.

    But I especially like the thought of for instance postfix running in a
    carefully crafted application container (with its own virtual network
    card and limited file tree and no visibility of other processes) with
    SECURE_NOROOT on.

    -serge

    > environment in which root has no privilege at all. One in which
    > privilege comes only from filesystem capabilities.
    >
    > | FWIW in Pardus 2008 we'll enable Posix file capabilities by default so
    > people
    > | could "harden" their setups.

    Cool. Be good to see how that goes. I'm curious about what conceptual
    hurdles there might be for sysadmins configuring libpam to exploit
    fI+pI.

    thanks,
    -serge

    >
    > Cheers
    >
    > Andrew
    > -----BEGIN PGP SIGNATURE-----
    > Version: GnuPG v1.2.6 (GNU/Linux)
    >
    > iD8DBQFHpmYd+bHCR3gb8jsRAlDHAJ9RvFRieU2eUPJUHh7K84NMLmytTQCgupfS
    > KxdoXz400AeMWJiaikGH9U8=
    > =yx8I
    > -----END PGP SIGNATURE-----
    > -
    > To unsubscribe from this list: send the line "unsubscribe
    > linux-security-module" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html


    \
     
     \ /
      Last update: 2008-02-04 17:47    [W:0.032 / U:2.044 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site