-----BEGIN PGP SIGNED MESSAGE-----
| If a have a service running in a vserver, and this service get
| an attacker, is the attacker confined to the vserver, so that he/she
| compromise any of the other services (running in other vservers), and
| can't modify files outside the filesystem of the compromised vserver?
A user inside the vserver has access to the filesystem and the processes
inside the vserver. If your setup does not share any resources between
more than one vserver, it is not possible for a user (attacker or legal
user - doesn't matter) to access filesystem resources outside the guest,
as long as you do not give special capabilities to the guest which
enable it to access kernel devices directly.
There might be the change that the process/resource isolation code of
vserver itself has bugs - in this case you will obvioulsy loose this
| Is a vserver context more secure than a chroot jail?
AFAIK a jail hides the filesystem but not processes - so I would give a
yes at least regarding this issue.
Protect your environment - close windows and adopt a penguin!
PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF 8168 CAB7 B0DD 3985 1721
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
Received on Thu May 15 23:19:51 2008