Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 23, 2013
An "enum" for Python 3
An unexpected perf feature
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
What is the recommended tool/way/option to use instead?
Of course, there is VmWare, etc., but it would be nice to have something like this for a ftp/sftp server, etc.
What chroot() is really for
Posted Oct 4, 2007 11:18 UTC (Thu) by petebull (guest, #7857)
Posted Oct 4, 2007 19:17 UTC (Thu) by sbergman27 (guest, #10767)
1. Keep it simple.
2. Keep it clear.
SELinux, as powerful and useful as it can be when it is really needed, fails both of those tests for most applications.
Posted Oct 4, 2007 23:07 UTC (Thu) by smoogen (subscriber, #97)
Posted Oct 5, 2007 4:04 UTC (Fri) by wahern (subscriber, #37304)
Also, if SELinux were actually easy to use, why don't Linux distributions ship with policies that don't frustrate users? That's not to say it can't be done. It's only evidence that it can't be done well, yet. In my opinion, there's some key abstraction missing which, when discovered, will likely make MAC schemes more intuitive, automagically adaptable to the environment, and much more common place than they are. We just aren't there yet. The evolution of Unix tells us that only those interfaces which have proven themselves become standardized across platforms. For my money, compartmentalized environments a la BSD jails/Solaris Zones seem to be the wave of the future, even if personally I'd like to see MAC schemes become the norm.
Lost in this whole debate is something called portability. As a developer, I'm not going to write software with the expectation that the user will run it in UML or a BSD jail. Fact is, chroot is available on every single Unix system, with identical semantics. I'll write my software as best I can so that diligent users can run software in a jail, but just because others can or would isn't reason to persuade me not to use chroot.
Posted Oct 5, 2007 12:38 UTC (Fri) by addw (guest, #1771)
why do a million administrators have to lock down applications when the developer could have written the application better to begin with.
Because security is best done in depth; ie multiple layers so that if one fails you hopefully prevent problems by another layer.
I am not saying that applications should not be well coded, but we need to be realistic and realise that all programs have bugs.
Posted Oct 5, 2007 15:46 UTC (Fri) by jond (subscriber, #37669)
Posted Oct 5, 2007 20:29 UTC (Fri) by wahern (subscriber, #37304)
chroot is not _the_ answer. In all this debate, either here or on LKML, I have yet to see anybody mistakingly suggest that chroot _alone_ is a sufficient measure. All of these straw men arguments that say that chroot shouldn't be used because chroot _alone_ isn't sufficient are fallacious.
I'm only sticking to my guns because these forums are archived, and I don't want to see a student or junior engineer come to me in 10 years and say they didn't use chroot, though they trivially could have, because they were told it was useless.
Posted Oct 6, 2007 1:40 UTC (Sat) by wahern (subscriber, #37304)
Posted Oct 11, 2007 7:12 UTC (Thu) by gat3way (guest, #47864)
And BTW there are quite a lot of ways to escape it as long as you're already a root. You can for example mount filesystems on some occasions.
Who said chroot() must provide security...against someone that already has root privilleges on that system???
Posted Oct 4, 2007 15:09 UTC (Thu) by ebiederm (subscriber, #35028)
That can give the same effect as chroot but without being able to escape.
For even more strength one of the linux security modules like AppArmor or
Selinux can help.
For more support making an application look like it has the box to itself
the ongoing work on namespaces can help. Ultimately though while the
namespaces can help improve security just like chroot that isn't their
Posted Oct 4, 2007 22:18 UTC (Thu) by dowdle (subscriber, #659)
For Linux there is OpenVZ and/or Linux-VServer... as well as the container features that have already made it into the mainline Linux kernel... and additional code that is expected to make it into the mainline kernel in the next year or so.
Anyway, if you want a quality isolation (and OS Virtualization as well), you can do so with OpenVZ and/or Linux-VServer. Of course both of those require a modified kernel... but they do work well, are mature, and offer additional features like resource management, separate root user and accounts, and in the case of OpenVZ, checkpointing (offline and online/live migration).
Posted Oct 5, 2007 3:34 UTC (Fri) by jordanb (guest, #45668)
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds