Hacker News Reader

Comment by pjmlp | Hacker News Reader

Traditional UNIX is no different. Without containers every p0wned process has full access to $HOME and can do everything the user is capable of.

I really like that Apple and Microsoft are pushing for sandbox models in their OSes.

View on HN

You can also use MAC and avoid container overhead. SELinux is the worst of the bunch because its a PITA to work with, while AppArmor profiles are pretty easy to write but its not particularly foolproof, Tomoyo has nobody developing good profiles for it, and we should all be running Grsec Kernels + PaX since its the best of all worlds but again nobody wants to put in the effort to develop all the profiles for all the programs we use, and learning modes are just unacceptable.

That is GNU/Linux specific, not UNIX.

Of course there are things like HP-UX safes, Tru64 and Solaris trusted zones.

None of them are POSIX.

Besides the average user would not even know where to start.

In all fairness, you don't run any modern UNIX server without giving each sensitive server its own user, which effectively sandboxes it (not quite the same as chroot/containers/VMs, but still). Of course, desktop UNIX/Linux tends to have many important processes running as the same user, but that falls under "Desktop OSes are generally pretty bad".

Everyone sane runs sensitive systems "system high" now, where there's a machine dedicated per task. User/process/thread security in UNIX/POSIX/etc. is bullshit weak sauce, sadly.

You can use VMs for some of that, but that's the limit on sharing (and that's if you trust your hypervisor to be a separation kernel thing; reasonable for many people. Not for others.) Docker/containers isn't enough. Users aren't enough. Processes aren't enough.

Reply on news.ycombinator.com