From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Wed 08 Oct 2003 - 19:48:36 BST
On Wed, Oct 08, 2003 at 02:38:20PM -0500, Jacques Gelinas wrote:
> On Wed, 8 Oct 2003 07:59:03 -0500, Rik van Riel wrote
> > On Tue, 7 Oct 2003, Alex Lyashkov wrote:
> > > On Tuesday 07 October 2003 03:34, Jacques Gelinas wrote:
> >
> > > > chrootsafe
> > > >
> > > > This is a new system call that unlike chroot, can't be escaped.
> >
> > > why don`t use private namespace ?
> >
> > Good question. Using CLONE_NEWNS followed by a recursive
> > bind mount to hide everything else would be so much better
> > than adding a new syscall.
>
> This is probably a minor problem, but if we want to support vservers inside
> vserver we must allow mount ? This is a problem. mount let you DOS
> a machine. Further, mount is covered by a very broad capability.
>
> Am I missing something ?
yes ;)
we had some discussion about adding vserver
specific capabilities, and I guess they could
be useful for a finer grained capability system
and we can limit the mount in various ways
(was already discussed for loop mounts ...)
best,
Herbert
>
> ---------------------------------------------------------
> Jacques Gelinas <jack_at_solucorp.qc.ca>
> vserver: run general purpose virtual servers on one box, full speed!
> http://www.solucorp.qc.ca/miscprj/s_context.hc