Date: Wed, 7 Jun 2006 09:08:50 -0700 From: Brooks Davis <brooks@one-eyed-alien.net> To: John Baldwin <jhb@freebsd.org> Cc: Alex Lyashkov <shadow@psoft.net>, Robert Watson <rwatson@freebsd.org>, Julian Elischer <julian@elischer.org>, freebsd-arch@freebsd.org Subject: Re: jail extensions Message-ID: <20060607160850.GB18940@odin.ac.hmc.edu> In-Reply-To: <200606070819.04301.jhb@freebsd.org> References: <1149610678.4074.42.camel@berloga.shadowland> <448633F2.7030902@elischer.org> <20060607095824.W53690@fledge.watson.org> <200606070819.04301.jhb@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Wed, Jun 07, 2006 at 08:19:03AM -0400, John Baldwin wrote: > On Wednesday 07 June 2006 04:59, Robert Watson wrote: > > > > On Wed, 7 Jun 2006, Julian Elischer wrote: > > > > >> I'd like to clarify Alex's point a bit: he wants to know his work is > > >> acceptable by the project and could be merged. It's obvious it's almost > > >> impossible to maintain that outside of the tree. > > >> > > > I'd like to see him merge his project with Marco's . If so then I'd be > more > > > than happy to see this stuff come in once it reaches a certain level of > > > maturity. > > > > > > Marco and I have been going over some possible macros that could be used > to > > > help with a lot of this and if the macros were used then some of the > changes > > > could come in quite early as they would compile out to NOPs for anyone not > > > using the changes. ( and provide an easy target for removal if it > eventually > > > doesn't complete). > > > > FYI, Marko was at the FreeBSD developer summit at BSDCan, and has expressed > > the intent of updating his patches to 6.x/HEAD, so I think there's > definitely > > room for collaboration here. > > What did you think about Alex's idea of a 'prison0' to for all "non-jailed" > processes so that lots of things can move into 'struct prison' and not > require as much special casing (though then there would be a different set of > special cases I guess as prison0 would be the only prison that could create > child prisons, etc.?) It's not clear to me that we want to use the same containers to control all resouces since you might want a set of jails sharing IPC resources or being allocated a slice of processor time to divide amongst them selves if we had a hierarchical scheduler. That said, using a single prison structure could do this if we allowed the administrator to specifiy a hierarchy of prisons and not necessicairly enclose all resources in all prisons. -- Brooks -- Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFEhvoRXY6L6fI4GtQRAu1zAJ9uEPD0Qgjc6lCkwLKtPHz8GaZ/bACcD3+g o4XWkMZrftZoZ0K5qqrweK0= =Xglg -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060607160850.GB18940>