Re: RFC: jail functionality

From: Stephen Smalley (sds@private)
Date: Thu Jun 30 2005 - 06:23:11 PDT

On Thu, 2005-06-30 at 09:19 -0400, Colin Walters wrote:
> But you should be aware that for a lot of the zone use cases, resource
> management is very important, and SELinux doesn't provide that.  You
> mention CKRM, but that's a whole other kernel patch.  Xen definitely
> seems to be the approach that's winning here.

IMHO, CKRM should be integrated with SELinux to allow policy control
over resource management.

For strict isolation (which does seem to be the theme of jail) as well
as complete transparency of that isolation, virtualization make sense.
But for controlled sharing, you will ultimately need OS-level controls.

Stephen Smalley
National Security Agency

This archive was generated by hypermail 2.1.3 : Thu Jun 30 2005 - 06:24:47 PDT