grsecurity docs: mention chromium setuid sandbox

This commit is contained in:
Joachim Fasting 2016-08-15 20:36:13 +02:00
parent 050b7eec16
commit f9c3076e58
No known key found for this signature in database
GPG key ID: 7544761007FE4E08

View file

@ -267,8 +267,8 @@
<itemizedlist>
<listitem><para>User namespaces require <literal>CAP_SYS_ADMIN</literal>:
consequently, unprivileged namespaces are unsupported. Applications that
rely on namespaces for sandboxing (e.g., chromium) must use a privileged
helper.</para></listitem>
rely on namespaces for sandboxing must use a privileged helper. For chromium
there is <option>security.chromiumSuidSandbox.enable</option>.</para></listitem>
<listitem><para>Access to EFI runtime services is disabled by default:
this plugs a potential code injection attack vector; use