Posted by flipped 20 hours ago
you think the reporters and the distribution maintainers colluded to... get 5 minutes of attention?
that would be exceptionally stupid of the distribution maintainers and destroy all trust.
It never did. Trawling the Linux commit history is a tried and true method for finding n-days.
That said, running every process in its own micro VM is looking more attractive by the minute.
But yes, micro VMs are a great idea!
It also saddens me greatly, imagining what computing could look like if systems evolved differently.
Containers are good, as long as they all share the same purpose (read: same application, no multi-tenant)
We all know that multi-users systems (and thus, containers) have a very wide attack surface, while VM attack surface is very limited ..
This is why I am totally convinced that:
- redhat and friends are a terrible idea (licencing forces collocation which reduces segmentation)
- per-instance pricing (read: cloud public, but not only that) are terrible: for the same reason. Paying per consumed CPU/ram is sane, paying per VM unit is damagefulHowever, if you are in a user namespace where UID 0 doesn't map to system-wide capabilities, and you dont share page cache for the setuid binaries on the system, this attack doesn't lead to LPE.
The entire point is that you can escalate to root