Live data from Hacker News

Escaping privileged containers for fun

pwning.systems

41–42 of 42 posts

Re: Escaping privileged containers for fun

#41

Earlier quoted context omitted.

> Is this "Linux is garbage" opinion shared broadly by security researchers? Everyone I know would agree, yeah. I think the infosec world is probably more or less aligned on this, as much as anything, although that's a low bar and there is no single infosec community. > what is "alienating" Decades of Linus and Greg insulting or attacking security researchers in various ways. It's become pretty antagonistic on both s…

Fair enough. While I understand that there may not be any body which perfectly represents the infosec community, I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?). No doubt that Linus is antagonistic. I haven't heard anything that suggests security researchers as a collective have taken it personally (I would expect they, like most people, understan…

> I would be curious if there are any surveys or even statements by somewhat authoritative bodies (something like NIST?).

Hmmm, I'm not sure if anything like that exists, certainly nothing from a standards body. The closest might be recommendations to not rely on things like Linux containers, or to be wary of kernel vulnerabilities. But usually official bodies don't make comments like "this software is bad".

> I haven't heard anything that suggests security researchers as a collective have taken it personally

I assure you that they do, I know many people who have been active in Linux kernel security for decades.

> It seems pretty meaningless and unhelpful to categorize all C software as "garbage".

Oh yeah, what I meant is that all of these things are factors. I'm sort of hand-wavingly justifying the "garbage" description. There's a lot of problems that are all interwoven. C is one of those problems.

> To deserve the "garbage" designation, I would expect some supporting evidence that the Linux kernel development process lacks rigor.

That's fair. I would probably point to the lack of testing/ coverage, the lack of code review, the huge LOC:maintainer ratio.

> Moreover, "secure" is relative, so if you're going to call the Linux kernel "garbage" then it seems like you should have some kernel which is not "garbage"

I'd have to disagree here. I don't believe I need to have an example of something better in order to point out that there's something bad.

Re: Escaping privileged containers for fun

#42
post #8
post #6

Earlier quoted context omitted.

There are _some_ containers that are security mechanism. Docker is definitely not one of them. But LXD for example uses unprivileged containers by default and can be hardened with additional software for syscall filtering

> uses unprivileged containers by default and can be hardened with additional software for syscall filtering You also described docker. I agree that docker's main focus isn't to be a security oriented sandbox, but perhaps you need to find a different wording of what exactly makes LXD (or others) so different.

> You also described docker.

Can docker do secure multiuser?

https://m.youtube.com/watch?v=6O0q3rSWr8A

Post reply on HN