81–86 of 86 posts
Important note on this: "Fortunately, the default security hardenings in most container environments are enough to prevent container escape. Containers running with AppArmor or SELinux are protected. " So, all that hard work on SELinux continues to pay off.
Sadly, many answers to questions related to selinux issues, or howto's start with: Disable selinux.
Earlier quoted context omitted.
That's fantastic for Fedora desktop users. I don't expect you'd know, but is there a way to get the same quality of information via a CLI command?
grep denied /var/log/audit/* On some systems the avc violations also get printed in dmesg. If violations block your whole system from even running, you can enable permissive mode, this only logs violations without enforcing them. As others already mentioned, turning violation logs into allow rules can be done with audit2allow. Wouldn’t recommend blindly using that though as the generated rules are always either too n…
Back in the day, people insisted that containers were not security boundaries and should not be treated as such. They're meant to contain things from going off the rails unintentionally, but an actual threat was another story. However, realistically, given the env that a container gives you, it certainly looks and feels like a security boundary. So are we just going to be stuck in this retroactive security cleanup mo…
How are they not a security boundary? Nearly everything is a security boundary using defense in depth no?
i.e. root inside a container is root on the host; the container itself doesn't help that. But other security features, that are applied to the processes within the container when the container is created, might.
- Stable: 5.16.6
- LTS (for Alpine Linux): 5.15.20
Alpine 3.15 main is currently at 5.15.16 and thus vulnerable.
Earlier quoted context omitted.
Fedora literally gives you a notification and you can take action (Me a as novice Linux user)
That's fantastic for Fedora desktop users. I don't expect you'd know, but is there a way to get the same quality of information via a CLI command?
From the top of my head, I don't know. But this might help: