| |||||||||||||
Cook: seccomp filter now in UbuntuCook: seccomp filter now in UbuntuPosted Mar 27, 2012 0:18 UTC (Tue) by luto (subscriber, #39314)In reply to: Cook: seccomp filter now in Ubuntu by slashdot Parent article: Cook: seccomp filter now in Ubuntu
Unprivileged users can't chroot (yet [1]) or use FS namespaces. And correctly detecting when execve(2) will run a setuid program is probably impossible except in very limited circumstances.
[1] https://git.kernel.org/?p=linux/kernel/git/luto/linux.git;... [but I doubt that patch will be accepted in its current form]
(Log in to post comments)
Cook: seccomp filter now in Ubuntu Posted Mar 27, 2012 0:33 UTC (Tue) by slashdot (guest, #22014) [Link]
Unprivileged users have to use nnp anyway.
Privileged users, in theory, could instead want to setup a FS namespace with some setuid programs of their choice.
However, this is probably useless in practice, so indeed it may be better to avoid the risk of an accidental security hole and force nnp on.
|
|||||||||||||