Re: [gentoo-dev] chroot USE flag?

[fede2@fuerzag.ulatina.ac.cr (Alvaro Figueroa Cabezas)]

Without having read a lot of systrace... I'm gonna risk and answer.

On Jul 18 07:43, Toby Dickenson wrote:

> I have recently adopted systrace as a "better chroot". I find it is easier to 
> set up a new service under systrace than both chroot and selinux. Unlike 
> chroot, it is easy to disable systrace briefly if you suspect the security 
> hardening may be causing a problem.

I found systrace and chroot as tools for diferent porpuses, not that one
can replace the other. By creating a chroot you are preemtively cutting
down the amount of damage a user can do if it passes down the security
of the application. I still need to break out of the chroot.

People has the idea that chroots are imposible to break out of. I know
that some of the guys in my LUG have succesfully (kinda like) gotten of
of it by inserting into the broken application, enough code to create a
device (as in mknod) and to mount that device inside the chroot.

By using capabilities (go out and fetch a 2.6 kernel!), the whole
concept of an all migthy root is obsoleted. You create a user with has
certain capabilities to do things, and that is all.

But hey, lets keep the discussion out of the thread on the dev mailing
list. I hope that this small enlightenment/clarification won't upset
anyone.

-- 
Alvaro Figueroa


--
gentoo-dev@gentoo.org mailing list