Subject: Re: extending chroot()
To: Christos Zoulas <christos@zoulas.com>
From: Daniel Carosone <dan@geek.com.au>
List: tech-security
Date: 01/23/2003 20:10:31
On Fri, Jan 17, 2003 at 06:40:45PM +0000, Christos Zoulas wrote:
> >>Isn't this where someone's supposed to pipe up and say "If you wanted
> >>Plan 9 then you know where to find it!"  :-)
> 
> There is nothing wrong with the `everything is a file' approach, and over
> the years many commercial and non commercial unixes have been gradually
> doing that.

Yeah, there are far too many namespaces (files, sockets, SHM&co,
sysctl, etc etc etc). We should be trying to at least contain the
number of new ones we create, and perhaps also consolidating some
that we already have (like the *ctl's).

smb: you want to look at systrace for coralling user apps, it's much
finer-grained. Think of it like a firewall for syscalls.

--
Dan.