Linux-VServer-Paper
Linux-VServer Technology
Paper (C)2004 Herbert Pötzl
00. Abstract
01. Introduction
02. The Concept
03. Existing Infrastructure
03.0. Linux Capability System 03.0.0. POSIX Capabilities 03.0.1. Capability Overview 03.1. Resource Limits 03.1.0. Limit-able Resource Overview 03.2. File Attributes 03.3. The chroot(1) Command
04. Required Modifications
04.0. Context Separation 04.1. Network Separation 04.2. The Chroot Barrier 04.3. Upper Bound for Caps 04.4. Resource Isolation 04.5. Filesystem XID Tagging
05. Additional Modifications
05.0. Context Flags 05.1. Context Capabilities 05.2. Context Accounting 05.3. Context Limits 05.4. Virtualization 05.5. Improved Security 05.6. Kernel Helper
06. Features and Bonus Material
06.0. Unification 06.1. Private Namespaces 06.2. The Linux-VServer Proc-FS 06.3. Token Bucket Extensions 06.4. Context Disk Limits 06.5. Per-Context Quota 06.6. The VRoot Proxy Device 06.7. Stealth
07. Linux-VServer Security
07.0. Secure Capabilities 07.1. The Chroot Barrier 07.2. Secure Device Nodes 07.3. Secure Proc-FS Entries
08. Field of Application
08.0. Administrative Separation 08.1. Service Separation 08.2. Enhancing Security 08.3. Easy Maintenance 08.4. Fail-over Scenarios 08.5. For Testing
09. Performance and Stability
09.0. Impact of Linux-VServer on the Host 09.1. Overhead inside a Context 09.2. Size of the Kernel Patch
10. Non Intel i386 Hardware
11. Linux Kernel Intro
11.0. Kernel and User Space 11.1. Linux Syscalls
12. Kernel Side Implementation
12.0. The Syscall Command Switch 12.1. Utilized Data Structures 12.1.0. The Context Data Structure 12.1.1. The Scheduler Command Data 12.1.2. Example Accounting: Sockets 12.1.3. Example Limits: Virtual Memory 12.1.4. Example Virtualization: Uptime
13. Future Directions
13.0. Hierarchical Contexts 13.1. Security Branch 13.2. Stealth Branch
14. Step by Step Examples
14.0. [E01] Linux Caps Example 14.1. [E02] Manipulating Linux Caps 14.2. [E03] CAP_MKNOD Example 14.3. [E11] Resource Limits via BASH 14.4. [E12] Example CPU Time Limit 14.5. [E13] Normal File without Attributes 14.6. [E14] Immutable File Attribute 14.7. [E15] Chroot Example 14.8. [E21] Process Isolation 14.9. [E22] Dual Context Isolation 14.10. [E23] Fake Init Process 14.11. [E24] Network Isolation 14.12. [E31] Context File Tagging 14.13. [E32] XID File Permissions 14.14. [E33] Context Flags 14.15. [E34] Context Capabilities 14.16. [E41] Context Accounting 14.17. [E42] Context Limits 14.18. [E43] Uptime Virtualization 14.19. [E44] ProcFS Guest Security 14.20. [E45] ProcFS Host Security 14.21. [XX] Not Included Yet