jail extensions
Brooks Davis
brooks at one-eyed-alien.net
Wed Jun 7 18:09:31 UTC 2006
On Wed, Jun 07, 2006 at 08:19:03AM -0400, John Baldwin wrote:
> On Wednesday 07 June 2006 04:59, Robert Watson wrote:
> >
> > On Wed, 7 Jun 2006, Julian Elischer wrote:
> >
> > >> I'd like to clarify Alex's point a bit: he wants to know his work is
> > >> acceptable by the project and could be merged. It's obvious it's almost
> > >> impossible to maintain that outside of the tree.
> > >>
> > > I'd like to see him merge his project with Marco's . If so then I'd be
> more
> > > than happy to see this stuff come in once it reaches a certain level of
> > > maturity.
> > >
> > > Marco and I have been going over some possible macros that could be used
> to
> > > help with a lot of this and if the macros were used then some of the
> changes
> > > could come in quite early as they would compile out to NOPs for anyone not
> > > using the changes. ( and provide an easy target for removal if it
> eventually
> > > doesn't complete).
> >
> > FYI, Marko was at the FreeBSD developer summit at BSDCan, and has expressed
> > the intent of updating his patches to 6.x/HEAD, so I think there's
> definitely
> > room for collaboration here.
>
> What did you think about Alex's idea of a 'prison0' to for all "non-jailed"
> processes so that lots of things can move into 'struct prison' and not
> require as much special casing (though then there would be a different set of
> special cases I guess as prison0 would be the only prison that could create
> child prisons, etc.?)
It's not clear to me that we want to use the same containers to control
all resouces since you might want a set of jails sharing IPC resources
or being allocated a slice of processor time to divide amongst them
selves if we had a hierarchical scheduler. That said, using a single
prison structure could do this if we allowed the administrator to
specifiy a hierarchy of prisons and not necessicairly enclose all
resources in all prisons.
-- Brooks
--
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-arch/attachments/20060607/53310f9f/attachment.pgp
More information about the freebsd-arch
mailing list