Add privilege dropping #35

New issue

Open

opened 2021-09-05 09:18:54 +00:00 by baez90 · 1 comment

baez90 commented

2021-09-05 09:18:54 +00:00

(Migrated from gitlab.com)

Since Go 1.16 privilege dropping with unix.Setuid and unix.Setgid is finally possible.

A modified workflow could be:

start the container as root
chown the data directories
open the sockets
Switch identity and start listening

That way created files would be opened by a restricted user and opening more sockets would be impossible. On the other hand the setup of the data directories and Mlmulti-container environments would be easier to setup.

Same's true for scenarios running directly on a host which might come handy when not all files are owned by root

Since Go 1.16 privilege dropping with `unix.Setuid` and `unix.Setgid` is finally possible. A modified workflow could be: 1. start the container as root 2. `chown` the data directories 3. open the sockets 4. Switch identity and start listening That way created files would be opened by a restricted user and opening more sockets would be impossible. On the other hand the setup of the data directories and Mlmulti-container environments would be easier to setup. Same's true for scenarios running directly on a host which might come handy when not all files are owned by `root`

baez90 commented

2021-09-05 09:18:54 +00:00

(Migrated from gitlab.com)

assigned to @baez90

prskr added this to the Default project 2022-12-18 10:34:57 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: inetmock/inetmock#35

No description provided.