2011/12/1 Herbert Poetzl <herbert@13thfloor.at>:
> what kernel/patch versions are we talking about and
3.0.7-vs2.3.1
> why does it fail on the non-vserver machine?
It only fails on the non-vserver machine when running under strace:
$ strace -o _str -f chromium-browser
Failed to move to new PID namespace: Operation not permitted
$ strace -o _str -f chromium-browser --no-sandbox
# works except it says it's not using sandboxing
$ chromium-browser
# works normally
_str never contains any reference to SECCOMP, either because the
seccomp part would come up later than the pid namespacing, or because
it's not actually using seccomp anyway.
I've looked at the seccompsandbox project site[1], which indicates the
project is still actively developed, although it's not clear whether
it's being used in chromium or not; I'll try to find out more.
[1] http://code.google.com/p/seccompsandbox/
Christian.
Received on Thu Dec 1 21:34:15 2011