[lkml]   [2004]   [Oct]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch 1/3] lsm: add bsdjail module
    Thank you for the feedback.  I have implemented these changes, but
    want to run a few tests tomorrow before I send them out to make
    sure I didn't break anything...

    Quoting Andrew Morton (
    > Serge Hallyn <> wrote:
    > >
    > >
    > > Attached is a patch against the security Kconfig and Makefile to support
    > > bsdjail, as well as the bsdjail.c file itself. bsdjail offers
    > > functionality similar to (but more limited than) the vserver patch.
    > I don't recall anyone requesting this feature. Tell me why we should add
    > it to Linux?

    Because it gives Linux a functionality like FreeBSD's jail and Solaris'
    zones in an unobtrusive manner, without impacting users who don't wish
    to use it (except for the extra security_task_lookup function calls).
    It allows me (for instance) to compartmentalize apache and sendmail by
    running them in different jails. Or offer family members, customers,
    or whoever, ssh accounts into seemingly distinct boxes, which are simply
    sshd's under different jails at different network aliases. Each would
    see their own private filesystems and network, have their own usage
    limits, and (mostly) not see processes outside their respective jails.
    They can't {un,}load modules, ptrace unjailed processes or send signals
    to them, create devices, mount, or umount. It is functionality which
    otherwise would have to be achieved by running vmware or uml, but far
    more lightweight, since no new OS needs to be run. (Once read-only bind
    mounts are implemented, it will become even more lightweight, as large
    pieces of filesystem trees will be shareable readonly between jails.)

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:06    [W:0.019 / U:8.572 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site