From: Marc E. Fiuczynski (mef_at_CS.Princeton.EDU)
Date: Fri 17 Sep 2004 - 09:36:10 BST
Hi Sandino,
In what compelling VPS scenarios is the VPS administrator != host system
administrator?
Marc
-----Original Message-----
From: vserver-bounces_at_list.linux-vserver.org
[mailto:vserver-bounces_at_list.linux-vserver.org]On Behalf Of Sandino
Araico Sánchez
Sent: Wednesday, September 15, 2004 10:36 PM
To: vserver_at_list.linux-vserver.org
Subject: Re: [Vserver] Reiser4 views/process oriented security proposal
Christian Mayrhuber wrote:
>Could become interesting:
> http://www.namesys.com/blackbox_security.html
>
>
The process-oriented ACL seems functionality equivalent to grsec
process-based ACLs.
One disadvantage of grsec + vserver is that ACLs are applied system-wide
and must be administered on the mother server. The same applies to
iptables rules.
The advantage of Reiser's views model is that since they are defined on
the file attributes they can be defined inside the scope of the children
vservers so each vserver admin will be able to define his own ACLs just
by defining ACL attributes on every file to be execcuted.
The VPS administrators using Reiser 4 will be able to define
process-oriented ACLs as they wish whenever they wish while VPS
administrators using grsec ACLs must rely on their host system
administrator to apply the rules as they better understand.
>What do you think, maybe views instead of
>chroot() + mount --bind?
>
>
>
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver