Re: [vserver] Single application per VServer ?

What you've done is create a kernel level context isolating that
specific process. For eample if you wanted to kill the ssh process
then you could run:
 vcontext --migrate --xid $context bash

This will create an interactive shell and migrate the shell process to
kernel context $context. From there you could use said shell to
manipulate other processes in the same context including issuing a
'kill $pid'. If I've botched this in anyway please correct me Herbert
:P

On 1/19/10, Corey Wright <undefined@pobox.com> wrote:
> On Tue, 19 Jan 2010 16:41:37 +0100
> Shinkan <shinkan@gmail.com> wrote:
>
>> 2010/1/19 Shinkan <shinkan@gmail.com>
>>
>> >
>> >
>> > 2010/1/19 Corey Wright <undefined@pobox.com>
>> >
>> >
>> >> like an application-specific chroot, but with the added functionality
>> >> of linux-vserver?
>> >>
>> >
>> > Hi Corey,
>> >
>> > Thanks for your try.
>> > That's what I need yeah, "a (nearly) bullet proof chroot" to launch one
>> > service.
>> > And I want to use VServer as my "bullet proof chroot".
>> >
>> > i think vcontext.
>> >>
>> >
>> > I'll Google for it.
>> >
>>
>>
>> *crying*
>> That's one of the most un-successful search I've ever made.
>
> yeah, there's not much on vcontext, which is why i said you might want to
> go with more standard linux-vserver usage ("vserver <name> start") and
> heavily minimize/customize the vserver.
>
> if you are trying to reduce filesystem usage, then look into unification.
> if you are doing this to reduce attack surface (less tools to leverage once
> an attacker compromises the lone application).
>
>> I tried vcontext --create --xid 444 -- /etc/init.d/sshd start, and it
>> seemed to work, but I didn't get what was done at all.
>
> i only know to recommend:
> * vcontext --help
>
> to see how "vserver <name> start" leverages vcontext:
>
> * less /usr/sbin/vserver
> * less /usr/lib/util-vserver/vserver.start
> * less /usr/lib/util-vserver/vserver.functions
>
> yes, "use the source, luke" is probably not you were wanting.
>
> or jump on irc and ask there, as the linux-vserver irc channel has always
> been most responsive and helpful to me. (and then document whatever they
> tell you on the wiki. ;-)
>
>> Then, to be sure, I've done /etc/init.d/sshd stop (which worked), BUT I'm
>> still able to "ssh localhost" ??!
>> I can't find any ssh in "ps aux".
>
> try "vps" instead of "ps" to list processes running within vservers.
>
> corey
>
>> I really think like I don't understand what happened, and what vcontext
>> do.
>>
>> --
>> Pierre.
>> "Sometimes when I'm talking, my words can't keep up with my thoughts. I
>> wonder why we think faster than we speak. Probably so we can think
>> twice." - Bill Watterson
>>
> --
> undefined@pobox.com
>

-- 
Sent from my mobile device
Kyle