Re: Using fs views to isolate untrusted processes: I need an assistant architect in the USA for Phase I of a DARPA funded linux kernel project

[Hans Reiser <reiser@namesys.com>]

Hubert Chan wrote:

>>>>>>"Christian" == Christian Mayrhuber <christian.mayrhuber@gmx.net> writes:
>>>>>>            
>>>>>>
>
>Christian> Linux VServer might be a project that already tries to
>Christian> accomplish this task.
>
>After poking around the linux-veserver.org page, it sounds like Linux
>VServer is completely different from what Hans/Namesys is trying to do.
>Linux VServer still uses chroot.  From what I understand about views,
>you don't need to set up a chroot; applications run under the same
>filesystem as everything else.  You just need to, for example, say that
>apache is allowed to read from /etc/apache/*, /var/www, /usr/lib, etc.,
>and is allowed to write to /var/log/apache/*.  Then, even though apache
>is running under the same filesystem, it won't even be able to see, say
>/etc/passwd.
>
>  
>
Thanks for being more eloquent than what I was going to say.;-)