Re: prevent breaking a chroot() jail?

[Ville Herva]

On Fri, Jul 05, 2002 at 11:15:39AM -0700, you [H. Peter Anvin] wrote:
> 
> This sounds like a job for [dum de dum dum] capabilities... remember,
> on Linux root hasn't been almighty for a very long time, it's just a
> matter of which capabilities you retain.  Of course, if you really
> want to be safe, you might end up with a rather castrated root inside
> the chroot shell.
> 
> If you really want to jail something, use UML.

ISTR UML had some security problems (guest processes being able to disrupt
host processes or just guest processes being able to disrupt other guest
processes). Have those been resolved yet? 

Do people use it in production? Last I heard someone had evaluated it, it
had ended up consuming way too much CPU per "jail" for whatever reason.
Perhaps things are better already...

-- v --

[e-mail]