Re: [vserver] chromium/chrome in a vserver guest?

From: Christian Jaeger <chrjae_at_gmail.com>
Date: Thu 01 Dec 2011 - 21:33:40 GMT
Message-ID: <CAEjYwfW1k+oVLDpngSx0MCBfRv9LPLna7QqWzo8zOZ7YrhafLA@mail.gmail.com>

2011/12/1 Herbert Poetzl <herbert@13thfloor.at>:
> what kernel/patch versions are we talking about and

3.0.7-vs2.3.1

> why does it fail on the non-vserver machine?

It only fails on the non-vserver machine when running under strace:

$ strace -o _str -f chromium-browser
Failed to move to new PID namespace: Operation not permitted

$ strace -o _str -f chromium-browser --no-sandbox
# works except it says it's not using sandboxing

$ chromium-browser
# works normally

_str never contains any reference to SECCOMP, either because the
seccomp part would come up later than the pid namespacing, or because
it's not actually using seccomp anyway.

I've looked at the seccompsandbox project site[1], which indicates the
project is still actively developed, although it's not clear whether
it's being used in chromium or not; I'll try to find out more.

[1] http://code.google.com/p/seccompsandbox/

Christian.
Received on Thu Dec 1 21:34:15 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 01 Dec 2011 - 21:34:15 GMT by hypermail 2.1.8