Re:Stop Disabling SELinux: A Real-World Guide
by e12e on Thursday February 02, 2017 @11:39AM
(#13551865)
Nit; a (Linux) chroot is not a jail. A bsd jail is more like an lxc container.
Re:Stop Disabling SELinux: A Real-World Guide
by sh_tinh_hair on Thursday February 02, 2017 @12:35PM
(#13552450)
Understood. Same privilege escalation applies.
..and the syscall chroot is used between systems as a
primitive in either os space and semantic.
Re:Stop Disabling SELinux: A Real-World Guide
by Drdrdrq on Thursday February 02, 2017 @01:49PM
(#13553256)
Except AFAIK jail is meant to be secure while lxc (or at least docker) containers are not. Right?
Re:Stop Disabling SELinux: A Real-World Guide
by e12e on Thursday February 02, 2017 @03:07PM
(#13554108)
Lxc has since 1.0 come with isolation and security as part of it's design and feature set. Docker started as a convenient approach to bundling up chroots - and AFAIK hasn't really made much of a real effort wrt security - other than somewhat ill-advised approach to tacking on (enabling) a feature here or there... (That's not counting external projects like rkt running images as vms etc).
Lxc is much closer to jails in that sense - but eg lxc/Lxd on Ubuntu is hardly (meant to be) a silver bullet.
I wouldn't run an 'exposed' system that had SELinux support (and decent rules) without SELinux. Not discounting chroot, but given root a lot is possible in a jail.