News for hackers. Stuff that matters.

A comment on Open-sourcing gVisor, a sandboxed container runtime. Parent comment

Re:Open-sourcing gVisor, a sandboxed container runtime by dullgiulio on Wednesday May 02, 2018 @08:14AM (#16976178)
It rewrites the syscalls to make them succeed: reading a privileged file? Rewrite to read a non-privileged shadow file. Killing a privileged process? Return success without killing anything, etc.

Whatever is not rewritten will fail in kernel: there is no security risk.

[ Parent | on HN ]
Re:Open-sourcing gVisor, a sandboxed container runtime by xtrapolate on Wednesday May 02, 2018 @09:54AM (#16976852)
> "It rewrites the syscalls to make them succeed"

Imagine some applications expect the syscall to actually fail (ie. some odd way to test permissions).

I fail to grasp how this is a strength. Pulling the rug from under applications is dangerous. You're in a direct battle with internal implementation specifics - you don't want to get into that as an abstraction layer. You don't want to tailor various hacks for specific applications.

[ Parent | on HN ]