lkml.org 
[lkml]   [2005]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: BSD jail
    Quoting Serge E. Hallyn (serue@us.ibm.com)
    >Quoting Joshua Hudson (joshudson@gmail.com):
    > Why would you want a virtual network device implementation? The whole
    >
    >So that a jailed process can use the net but can't use your network
    >address (intercept ssh, imap/stunnel, etc).

    [snip]

    >But in the end vserver with read-only bind mounts seems a better way to
    >go imo.
    Latest version of linux vserver source: 100K bzipped
    Latest version of linux-jail: 34K uncompressed

    To build a virtual network device requires code for the device, code
    for routing the device
    in the kernel, some way to tell the router that this machine is hosted
    through the host
    machine's ethernet card, and control of which processes use which
    network devices.

    Way too much work for something intended to be simple and have essentially no
    overhead. All this work only gets jailed processes the ability to use
    127.0.0.1.
    The rest I can already do with eth0:1 and the specs for jail(2) from BSD.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-08-15 01:29    [W:2.766 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site