Re: goals for hardening Debian: ideas and help wanted

[Tzafrir Cohen <tzafrir@cohens.org.il>]

On Tue, Apr 29, 2014 at 11:24:19AM +0100, Kevin Chadwick wrote:
> previously on this list people contributed:
> 
> > > - easy create and run programs from chroot and alternate users  
> > 
> > Could you detail what you mean by this? It sounds like you want either
> > virtual machines or something like docker.io:
> > 
> > https://packages.debian.org/sid/docker.io
> 
> > > >
> > > > hint: chroot $CHROOT_PATH su - $USER -c "$command_with_args"  
> 
> > > > > Security and chroots aren't things I would associate, you need better.
> 
> A wide misconception. Chroots are easily implemented and add security
> almost for free 

Not completely for free. You now have an extra mini-system to maintain.

(often /dev/log is all that is needed) and so can be
> used by default without any potential problems, 

> they also never bring
> new risks

unless you forget to unpdate them.

It's also worth mentioning systemd-nspawn:
http://www.freedesktop.org/software/systemd/man/systemd-nspawn.html

-- 
Tzafrir Cohen         | tzafrir@jabber.org | VIM is
http://tzafrir.org.il |                    | a Mutt's
tzafrir@cohens.org.il |                    |  best
tzafrir@debian.org    |                    | friend