Messages in this thread | | | Date | Sun, 12 Sep 2004 23:12:45 +0200 | From | Herbert Poetzl <> | Subject | Re: [PATCH] BSD Jail LSM (2/3) |
| |
Greetings Serge!
On Fri, Sep 10, 2004 at 03:23:07PM -0500, Serge Hallyn wrote: > Attached is a patch against the security Kconfig and Makefile to support > bsdjail, as well as the bsdjail.c file itself. bsdjail offers > functionality similar to (but more limited than) the vserver patch. > > A process in a jail lives under a chroot which is not vulnerable to the > well-known chdir(...)(etc)chroot(.) attack against normal chroots, and > may be locked to one ip address. For additional features, please see > Documentation/bsdjail.txt, which is included in the next patch.
sounds good, maybe linux-vserver and bsdjail can share/utilize common code/functionality here?
(will have a look at the code soon)
also interresting enhancements might be
- private namespaces (linux-vserver uses them) - certain virtualizations (loadavg, ...)
anyway, let me know if you are interested in any cooperation ...
best, Herbert
> The patch applies cleanly to 2.6.8.1, and has been tested on xSeries, > pSeries, and zSeries. > > Please apply. > > Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> > > -serge
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |