From: daw@mozart.cs.berkeley.edu (David Wagner)
To: linux-kernel@vger.kernel.org
Subject: Re: can chroot be made safe for non-root?
Date: 18 Oct 2002 20:14:17 GMT [thread overview]
Message-ID: <aopq2p$9pm$2@abraham.cs.berkeley.edu> (raw)
In-Reply-To: 20021018190101.GE237@elf.ucw.cz
Pavel Machek wrote:
>> I am eager to be able to sandbox my processes on a system without the
>> help of suid-root programs (as I prefer to have none of these on my
>> system).
>
>You can do that using ptrace. subterfugue.sf.net.
ptrace() is ok, but it also has lots of disadvantages: performance,
expressiveness, security, assurance. I've posted before on this mailing
list, at length, about them. In short, ptrace() is not an ideal solution,
and a secure chroot() or other way to construct a jail/sandbox would
be better. (LSM will be much better.)
next prev parent reply other threads:[~2002-10-18 20:25 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-16 5:51 can chroot be made safe for non-root? Eric Buddington
2002-10-16 6:44 ` Philippe Troin
2002-10-16 21:18 ` David Wagner
2002-10-16 22:04 ` Philippe Troin
2002-10-16 22:00 ` David Wagner
2002-10-19 17:44 ` Eric Buddington
2002-10-19 19:07 ` Bernd Eckenfels
[not found] ` <200210201715.07150.landley@trommello.org>
2002-10-21 20:29 ` Bernd Eckenfels
2002-10-22 15:42 ` Jesse Pollard
2002-10-22 16:55 ` Shaya Potter
2002-10-21 15:22 ` Alan Cox
2002-10-22 7:21 ` Ville Herva
2002-10-22 14:15 ` Shaya Potter
2002-10-22 15:55 ` Martin Josefsson
2002-10-16 21:14 ` David Wagner
2002-10-18 19:01 ` Pavel Machek
2002-10-18 20:14 ` David Wagner [this message]
2002-10-18 21:07 ` Shaya Potter
2002-10-18 21:00 ` David Wagner
2002-10-18 21:36 ` Shaya Potter
-- strict thread matches above, loose matches on Subject: below --
2002-10-17 5:08 Niels Provos
2002-10-19 19:42 Hank Leininger
2002-10-20 10:40 ` Bernd Eckenfels
2002-10-20 14:49 ` Shaya Potter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='aopq2p$9pm$2@abraham.cs.berkeley.edu' \
--to=daw@mozart.cs.berkeley.edu \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox