About this list Date view Thread view Subject view Author view Attachment view

From: Jacques Gelinas (jack_at_solucorp.qc.ca)
Date: Wed 08 Oct 2003 - 20:38:20 BST


On Wed, 8 Oct 2003 07:59:03 -0500, Rik van Riel wrote
> On Tue, 7 Oct 2003, Alex Lyashkov wrote:
> > On Tuesday 07 October 2003 03:34, Jacques Gelinas wrote:
>
> > > chrootsafe
> > >
> > > This is a new system call that unlike chroot, can't be escaped.
>
> > why don`t use private namespace ?
>
> Good question. Using CLONE_NEWNS followed by a recursive
> bind mount to hide everything else would be so much better
> than adding a new syscall.

This is probably a minor problem, but if we want to support vservers inside
vserver we must allow mount ? This is a problem. mount let you DOS
a machine. Further, mount is covered by a very broad capability.

Am I missing something ?

---------------------------------------------------------
Jacques Gelinas <jack_at_solucorp.qc.ca>
vserver: run general purpose virtual servers on one box, full speed!
http://www.solucorp.qc.ca/miscprj/s_context.hc


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 08 Oct 2003 - 20:06:35 BST by hypermail 2.1.3