Hacker News
new
|
past
|
comments
|
ask
|
show
|
jobs
|
submit
login
staticassertion
on March 27, 2022
|
parent
|
context
|
favorite
| on:
Firejail: Linux namespaces and seccomp-bpf sandbox
Honestly, user namespaces might be scarier to me than setuid lol hopefully one day that will change.
gnoack
on March 28, 2022
[–]
Sorry, my English... :) I meant "Unlike namespaces", not "Other than namespaces" -- Landlock does not use namespaces.
staticassertion
on March 28, 2022
|
parent
[–]
Yeah, I realized after that that was probably the case. I assume it uses unpriv ebpf? A bit less scary lol
gnoack
on March 30, 2022
|
root
|
parent
[–]
eBPF was the initial proposal, but Landlock didn't go with it in the end. It's just using a set of regular system calls, the logic behind it is just implemented in C in the kernel as a LSM.
Guidelines
|
FAQ
|
Lists
|
API
|
Security
|
Legal
|
Apply to YC
|
Contact
Search:
