Re:The Insecurity of OpenBSD (2010)
by rwj on Tuesday November 29, 2016 @02:44PM
(#13065676)
I'm not sure that containers will help with security profiles. They should help with (for example) privilege escalation, but you will still be left with managing what systems/programs need access to what resources.
[ Parent
| on HN ]
Re:The Insecurity of OpenBSD (2010)
by dispose13432 on Tuesday November 29, 2016 @03:56PM
(#13066217)
While containers can't help against privilege escalation, they help against information leakage.
For example, even assuming privilege escalation isn't a possibility, www-user can read /etc/passwd, getting all usernames. Containers help mitigate this.
Re:The Insecurity of OpenBSD (2010)
by module0000 on Tuesday November 29, 2016 @05:16PM
(#13066703)
If your www-user can read /etc/passwd without 'avc: denied' appearing in your selinux log, you are doing it wrong.
The whole idea behind selinux is to prevent this scenario from ever happening. Apache has a policy written for it, that specifies precisely which paths and contexts apache needs <X> type of access to. If it tries to access anything outside those paths and context, the selinux module denies the attempt. It's foolproof if you use it. It's also incredibly annoying if you are on a system with selinux enabled, but aren't familiar with selinux.
Re:The Insecurity of OpenBSD (2010)
by dispose13432 on Tuesday November 29, 2016 @05:23PM
(#13066747)
It's true, but containers are much easier to play with if your distro doesn't come with sane presets (Debian, for one)