Matthew Pounsett <m...@conundrum.com> wrote: > > Privsep doesn't actually fix the same problem chroot does. As I > understand it, privsep reduces the attack surface for remote execution > exploits by shuffling off privileged operations to a separate process, but > if that process isn't chrooted and it has a remote code execution flaw then > your entire system is opened up to attack.
Actually it is normal for privsep processes to chroot themselves, usually to /var/empty - e.g. https://github.com/openssh/openssh-portable/blob/master/sshd.c#l642 https://github.com/openntpd-portable/openntpd-openbsd/blob/master/src/usr.sbin/ntpd/ntp.c#l130 Tony. -- f.anthony.n.finch <d...@dotat.at> http://dotat.at/ - I xn--zr8h punycode Biscay: North 4 or 5. Slight or moderate. Showers. Good. _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
