Tag Archives: Linux

Containers: Rootful, Rootless, Privileged and Super Privileged

This article is about containers, the different types (depending on what privileges we let them have), and how they build their isolation: mainly kernel namespaces and capabilities, overlay filesystems, seccomp, and SELinux. My motivation to start this article was for me to understand a bit better how the combination of container isolation mechanisms and privileges affects (increasing or decreasing) the risk of kernel flaws.

Continue reading

Introduction to Landlock

Note: I published this post in a previous blog i closed. Now I’m re-publishing it here.

Landlock is yet another sandoxing mechanism for Linux, but with important differences. Its goal is to make possible to restrict access rights to different Linux elements (e.g. filesystem access), in a secure and programmatic way, without the need of admin privileges.

Continue reading