Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-31 Thread intrigeri
Hi, Geoff Down wrote (29 Aug 2010 20:00:55 GMT) : > BTW is there somewhere from where the CACert root certificate (or > fingerprint) can be downloaded with protection from an SSL cert I > already trust? The above link, once corrected, generates an SSL > warning. GD Debian (and derivatives) users

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-29 Thread coderman
On Sat, Aug 28, 2010 at 3:25 PM, intrigeri wrote: >... > Please don't misunderstand me. I'm not a fan of VM-based solutions and > pretty much prefer the bare-metal + Live OS approach, but I feel we > need to consider their pros and cons in a more detailed way than > discarding them on the assumpti

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-29 Thread coderman
On Sat, Aug 28, 2010 at 3:25 PM, intrigeri wrote: > ... > Another "cost" mentioned by coderman was "elevated privs for > accelerated virtualization / para-virtualization". AFAIK VirtualBox > does not need any special privileges (once the kernel part of the > software is installed, and the modules/

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-29 Thread Geoff Down
On Sun, 29 Aug 2010 00:25 +0200, "intrigeri" wrote: > Hi, > > Gregory Maxwell wrote (22 Aug 2010 00:55:49 GMT) : > > I think it's obvious that the best way of using tor is running your > > torrified apps in a VM which can only access the outside world via > > TOR. > > I doubt there is somethin

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-29 Thread intrigeri
Hi, Gregory Maxwell wrote (22 Aug 2010 00:55:49 GMT) : > I think it's obvious that the best way of using tor is running your > torrified apps in a VM which can only access the outside world via > TOR. I doubt there is something like "the" best way of using Tor. One always needs to balance the ris

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-23 Thread coderman
On Sat, Aug 21, 2010 at 5:55 PM, Gregory Maxwell wrote: > ... > I think it's obvious that the best way of using tor is running your > torrified apps in a VM which can only access the outside world via > TOR. This provides the highest protection from network leaks and also > partially thwarts finge

Re: Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-21 Thread F. Fox
It certainly sounds interesting. Full VM environments not only cause system resource overhead, but maintenance overhead, too (that's always been my biggest gripe about them). F. Fox On 08/21/2010 05:55 PM, Gregory Maxwell wrote: (snip) Has anyone looked into using the SELINUX sandbox (http://