| |||||||||||||
The isolate utilityThe isolate utilityPosted Jan 5, 2010 19:38 UTC (Tue) by Richard_J_Neill (subscriber, #23093)In reply to: The isolate utility by Tet Parent article: The isolate utility
> Also, to quote Alan Cox, "chroot is not and never has been a security
> tool".
Indeed. As I see it, chroot can be used to protect against accidental bugs, but not deliberate ones.
For example, a non-malicious mistake in a program could quite easily delete the wrong file. Chroot could make that file inaccessible to that process, thereby protecting it.
It's very easy to exit the chroot jail deliberately, but hard to do so inadvertently. So it's still a useful tool to protect against innocent mistakes, but not against evil.
(Log in to post comments)
The isolate utility Posted Jan 6, 2010 10:46 UTC (Wed) by iq-0 (subscriber, #36655) [Link]
It even helps for deliberate ones, for a lot of attacks are based on races in file access. By locking a non-root process in a directory where it has absolutely no rights for (except for 'execute') helps limit the possible attack angles a lot by allowing less direct interactions with your environment.
Security is the sum of it's parts and no matter how evil you are, you still must exploit a weakness and anything that limits the possible weaknesses (even if it's one less) helps.
So this does help against evil even though it's not an end-all solution.
|
|||||||||||||