|
|
|
|
|
|
by lclarkmichalek
4111 days ago
|
|
|
Chroot (grsecurity makes this a lot better), the various namespaces, syslinux, seccomp. Seccomp has strict mode, which allows you to say to the kernel "from this point on, allow me to only do read, write (to fd's I already have opened), _exit and sigreturn, otherwise kill the program". It's not perfect, but it reduces the vunrel space a lot. You can also do a lot more fancy stuff, using the seccomp BPF interface (which I'm totally not writing a Haskell DSL for right now :D) |
|
|