Re: [Gnu-arch-users] Arch Roadmap Draft (the anticipated part 3)

[Zenaan Harkness]

On Wed, 2004-07-07 at 16:17, Cameron Patrick wrote:
> James Blackwell wrote:
> > What do you think about a ulimited, chrooted shell?
> 
> That could still potentially do nasty things over the network.
> Something like User Mode Linux or FreeBSD's jail would be more
> secure.
> 
> Another possibility that I've seen used quite successfully (in an
> on-line judging system for a programming competition) is to ptrace the
> process and intercept every system call and make sure that it isn't
> doing anything untoward.  I think that it would be a massive waste of
> effort in this case, though.

vservers people:

http://www.linux-vserver.org/

Yet at the end of the day, it's really just an extension of the chroot
concept to encompass '"security contexts", segmented routing, chroot,
extended quotas and some other standard tools'.

Having a syscall approach is surely the most performant course! (UML?
for a cms repository? <shudder!/>.)

In my memory, there was definite Linux-kernel talk about more
substantial vserver work in the mainline, for Linux 2.7. And for now,
the vserver project collects and actively works in this area.

cheers
zen