Security

From CRIU
Jump to: navigation, search

Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. The plan is to provide user-mode, but it will have restrictions.

Service mode[edit]

If CRIU is run as service from root, make sure the connection socket is restricted to unauthorized access. The service doesn't make any additional checks about the RPC caller, it just goes and performs the requested action.

See also[edit]

CRIU has security issues when working with user namespaces and selinux