News for hackers. Stuff that matters.

A comment on Linux kernel use-after-free in Netfilter, local privilege escalation. Parent comment

Re:Linux kernel use-after-free in Netfilter, local privilege... by galangalalgol on Tuesday May 09, 2023 @08:33PM (#35882166)
That is part of enabling rootless containers on rhel or similar.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by waynesonfire on Tuesday May 09, 2023 @10:22PM (#35882895)
should have re-written it in rust.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by yjftsjthsd-h on Wednesday May 10, 2023 @01:35AM (#35884008)
Rewritten what? The container runtime will need the same access regardless of what it's written in, and rewriting all of Linux (the kernel) would be... ambitious, although it is adopting rust incrementally.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by scns on Wednesday May 10, 2023 @08:09AM (#35886194)
The good old Strangler Pattern.

https://martinfowler.com/bliki/StranglerFigApplication.html

[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by galangalalgol on Wednesday May 10, 2023 @08:31AM (#35886400)
Some of the issue though is that a monolithic kernel provides more access than necessary to many things. When they made the locks granular, those might be reasonable boundaries for permissions? At this point I'd rather figure out how to make windows drivers work in redox or something crazy like that.
[ Parent | on HN ]