not a weeb
trans rights 🏳️‍⚧️🏳️‍🌈
they/them

  • 2 Posts
  • 5 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle




  • I have a relatively small setup, because of space and cooling constraints, but in that setup:

    • Generic server with a Xeon E5-2697 v2, kinda old but it’s still got 12c/24t, and 64 gigs of memory
    • Around 40TB of storage space, of which I’m using roughly 1%. I’m not even a datahoarder, I’m just a storage space hoarder.

    Everything I self host runs through Proxmox, either as a LXC container or as a RHEL 9 virtual machine. I also have a RasPi running Pi-Hole for ad blocking.



  • That’s a really interesting bypass; I wonder how this can be patched or mitigated considering the module is entirely loaded from memory. Short of setting noexec on temporary directories, I can’t think of any quick short term fixes.

    Edit: Re-read the blog post and looked at the Github repo for the code- looks like this is more of a proof of concept of a SELinux confine bypass, as the kernel needs to be compiled with CONFIG_SECURITY_SELINUX_DEVELOP set. See the readme here, there’s some more notes that weren’t included in the blog post.