Open main menu

CRIU β

Security

Revision as of 09:28, 14 December 2016 by Xemul (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Due to restrictions imposed by several kernel APIs CRIU uses, the tools can only work with run with root privileges. The plan is to provide user-mode, but it will have restrictions.

Service modeEdit

If CRIU is run as service from root, make sure the connection socket is restricted to unauthorized access. The service doesn't make any additional checks about the RPC caller, it just goes and performs the requested action.

See alsoEdit

CRIU has security issues when working with user namespaces and selinux