News for hackers. Stuff that matters.

A comment on SELinux is unmanageable; just turn it off if it gets in your way. Parent comment

Re:SELinux is unmanageable; just turn it off if it gets in y... by ethbr0 on Wednesday April 27, 2022 @03:05PM (#31184366)
One side has a huge footprint to secure (software-system), because it's every way software could ever need to interact with a local system.

The other can expose a much smaller one (container-system), because it only needs to include things one would have gone off-local-machine for (i.e. networking).

So from a security boundary, containers are basically a machine-internal firewall between programs and the host.

[ Parent | on HN ]
Re:SELinux is unmanageable; just turn it off if it gets in y... by throw0101a on Wednesday April 27, 2022 @03:16PM (#31184496)
> So from a security boundary, containers are basically a machine-internal firewall between programs and the host.

Which is only useful if they actually provide security.

[ Parent | on HN ]
Re:SELinux is unmanageable; just turn it off if it gets in y... by ethbr0 on Wednesday April 27, 2022 @05:46PM (#31186220)
You're missing my point.

It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem)

The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security).

Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.

[ Parent | on HN ]