News for hackers. Stuff that matters.

A comment on Google Chromium drops support for Linux 3.16 and earlier. Parent comment

Re:Google Chromium drops support for Linux 3.16 and earlier by strcat on Sunday March 08, 2015 @12:13PM (#9166032)
> Of course, seccomp-nonbpf, selinux and quite a few other mechanisms have been around for a longer while. In non-Linux kernels in fact, there are FAR more secure mechanisms (but also, they don't run Linux binaries..)

You're quite confused. SELinux, AppArmor, SMACK, etc. do not overlap with seccomp-bpf which exists to protect the kernel itself. Chromium has a working sandbox with or without seccomp-bpf based on a chroot, namespaces and IPC protocols. It needs seccomp to mitigate kernel vulnerabilities, which are not at all uncommon.

[ Parent | on HN ]
Re:Google Chromium drops support for Linux 3.16 and earlier by zobzu on Wednesday March 11, 2015 @03:29AM (#9182986)
they actually do the control in a very similar way. its the model of how the control is decided that differs. in other words, they're all blocking syscalls depending on the arguments/syscall name/etc. LSMs and seccomp-bpf alike.

So no, I'm not confused :)

[ Parent | on HN ]