Hacker News Reader

I see so much discussion of preventing _local_ escalation, but at this point almost all my services run in VMs/on dedicated hardware. Superuser powers don't buy you anything extra there.

What I really would like more discussed is _network_ isolation. You don't need root to exfiltrate tons of data.

View on HN

See this comment: https://news.ycombinator.com/item?id=35862698

If you implement socket activation and use an empty network namespace your service can be totally disconnected from any network and still handle requests (because the socket FD it listens on was inherited from systemd). This makes exfiltration much more difficult.

Is there any way to do that for systems without systemd, like Devuan?

Sure, s6 has the same feature. Systemd just made up a fancy name ("socket activation") for it which is why people mistakenly assume you need systemd for it.

https://skarnet.org/software/s6/s6-fdholderd.html

https://wiki.gentoo.org/wiki/S6/File_descriptor_holder

http://www.skarnet.org/software/s6/socket-activation.html

Thanks!

> almost all my services run in VMs/on dedicated hardware

Sounds like you could benefit from Qubes OS.

Reply on news.ycombinator.com