Subject: Re: replace chroot() with a chroot overlay file system?
To: None <tech-security@NetBSD.org>
From: haad <haaaad@gmail.com>
List: tech-security
Date: 11/07/2005 22:26:43
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Matthias Scheler wrote:
> On Mon, Nov 07, 2005 at 08:09:47AM +0000, Matthias Scheler wrote:
> 
>>Zones are virtual hosts sharing a single kernel. The global zone (the
>>real system) has full access rights to everything, all the other so
>>called local zones are restricted. They are e.g. trapped in a sub
>>directory of the filesystem space, cannot configure network interfaces
>>and don't see other zones. Each local zones gets one or more
>>IP addresses configured in the global zone for network connectivity.
>>Although all zones share one network stack they are limitted to using
>>their own IP addresses and have seperate TCP and UDP port spaces.
> 
> 
> Here is the link to Sun's documentation about it:
> 
> 	http://www.sun.com/software/solaris/ds/utilization.jsp
> 
> 	Kind regards
> 

I look at the opensolaris source code and found this bit of information:)
http://cvs.opensolaris.org/source/xref/on/usr/src/uts/common/os/zone.c


A zone is a named collection of processes, namespace constraints,and
other system resources which comprise a secure and manageable
application containment facility.

The global zone (zoneid 0) is automatically associated with all

system resources that have not been bound to a user-created zone.
This means that even systems where zones are not in active use
have a global zone, and all processes, mounts, etc. are
 associated with that zone.



- --

Linux is for people who hate windows NetBSD is for people who love UNIX.

				
W
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (NetBSD)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDb8aT9Wt2FT7y228RAqoSAJ4r9py2e6Lu0N64P/7ysa17e9sK0QCdEpqB
1vCOMXFUlDJ4jasIIDc8Oo4=
=kh+Y
-----END PGP SIGNATURE-----