Re: [vserver] vserver security

From: Oliver Welter <mail_at_oliwel.de>
Date: Thu 15 May 2008 - 23:19:38 BST
Message-ID: <482CB6FA.3050604@oliwel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Giovanni,

| If a have a service running in a vserver, and this service get
compromised by
| an attacker, is the attacker confined to the vserver, so that he/she
can't
| compromise any of the other services (running in other vservers), and
he/she
| can't modify files outside the filesystem of the compromised vserver?

A user inside the vserver has access to the filesystem and the processes
inside the vserver. If your setup does not share any resources between
more than one vserver, it is not possible for a user (attacker or legal
user - doesn't matter) to access filesystem resources outside the guest,
as long as you do not give special capabilities to the guest which
enable it to access kernel devices directly.

There might be the change that the process/resource isolation code of
vserver itself has bugs - in this case you will obvioulsy loose this
security.

| Is a vserver context more secure than a chroot jail?
AFAIK a jail hides the filesystem but not processes - so I would give a
yes at least regarding this issue.

Oliver
- --
Protect your environment - close windows and adopt a penguin!
PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF 8168 CAB7 B0DD 3985 1721
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFILLb6yrew3TmFFyERAnSsAJ98cf3POkghS/uIh2/U+g+u2fISUwCcDPWx
/pNLbMdGnxgA57TDLvvJDKU=
=TQNT
-----END PGP SIGNATURE-----
Received on Thu May 15 23:19:51 2008

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 15 May 2008 - 23:19:52 BST by hypermail 2.1.8