Well, it is off topic IMHO with the principal mail subject but the discussion is so interesting so some consideration on the point could be useful<br><br><a href="http://etbe.coker.com.au/2007/08/22/se-linux-vs-chroot/">http://etbe.coker.com.au/2007/08/22/se-linux-vs-chroot/<br>
</a> <br>of Russel Cooker<br><br><br><br><div class="gmail_quote">On Mon, Nov 10, 2008 at 2:26 PM, Adam Tkac <span dir="ltr"><<a href="mailto:atkac@redhat.com">atkac@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Mon, Nov 10, 2008 at 06:58:38AM -0500, Alan Cox wrote:<br>
> On Mon, Nov 10, 2008 at 01:34:23PM +0100, Adam Tkac wrote:<br>
> > Chroot is good and traditional method how restrict daemons. Many users<br>
> > still use it and it is far more easy create chroot configuration than<br>
> > create/maintain SELinux policy. I don't think SELinux obsoletes<br>
> > chroot, both try restrict daemon privileges and both have + and -.<br>
><br>
> chroot isn't a security feature. It helps for some non-root cases but there<br>
> are ways out of chroots and there are all sorts of fun things that can be<br>
> used to escape a chroot in the right circumstances.<br>
<br>
</div>Well, we are quite OT but could you point me how daemon could escape chroot<br>
when it is written correctly?<br>
<div class="Ih2E3d"><br>
><br>
> Its also inadequate for some forms of attack. If I can persuade your named to<br>
> run code of my choice in a chroot without selinux then I can still use your<br>
> box as a spam machine, botnet host, DoS attack tool, proxy, etc .. all without<br>
> breaking the chroot.<br>
><br>
> In the SELinux case a lot of those actions will hit SELinux denials.<br>
><br>
<br>
</div>Right you are but when you are using chroot it is very hard to do<br>
such attack. I think it is nearly impossible insert and run such long<br>
arbitrary code especially when binary is compiled with stack protector.<br>
<br>
Make sure I also think SELinux is better but it doesn't mean that<br>
chroot is useless and obsoleted.<br>
<div class="Ih2E3d"><br>
Adam<br>
<br>
--<br>
Adam Tkac, Red Hat, Inc.<br>
<br>
--<br>
</div><div><div></div><div class="Wj3C7c">fedora-devel-list mailing list<br>
<a href="mailto:fedora-devel-list@redhat.com">fedora-devel-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/fedora-devel-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-devel-list</a><br>
</div></div></blockquote></div><br>