Herbert Poetzl wrote:
>On Wed, May 10, 2006 at 02:46:34PM -0400, Fareha Shafique wrote:
>
>
>>After asking various questions about unification, I don't think vhashify
>>quite supports what I have in mind. I wanted to get some opinions/ideas
>>from the users of this mailing list.
>>
>>I am thinking if vservers can somehow be used to provide MAC (Mandatory
>>Access Control) through containers. For example, a vserver shares the
>>same filesystem as the host server, with read and write access to the
>>host files being defined through a set of MAC policies. In this way,
>>different policies can be defined for different vservers. Also, writes
>>can be contained within a vserver (so that if a file is written to, a
>>copy is made in the vserver's space) and integrated with the host only
>>through explicit 'commits' to allow, for example, new configurations to
>>be tested in an environment exactly the same as the host server and then
>>transferred to the host using a commit.
>>
>>
>
>
>
>>Any comments please?
>>
>>
>
>sounds interesting, any ideas how to realize this?
>
>
>
Well, my first impression of vservers was that it provided a kind of
containment that I have mentioned. I mean after quickly going over the
short introduction, I thought that a vserver has read only access to the
host server's files and CoW is used whenever the vserver modifes a file.
However, after installing a vserver, I realized this was not the case.
And after asking a few questions on the mailing list, I learnt that
there is no direct way to do this. I was hoping to find out what some of
those involved in the development of linux-vserver thought about the
feasibility of this idea.
So basically, at the moment, I don't really have much idea how to
realize this, but I am hoping those more involved with vserver will some
ideas to share :)
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Wed May 10 22:18:28 2006