Linux-VServer-Paper

From Linix VServer
Jump to navigationJump to search

Linux-VServer Technology

Paper (C)2004 Herbert Pötzl

00. Abstract

01. Introduction

02. The Concept

03. Existing Infrastructure

03.0. Linux Capability System 03.0.0. POSIX Capabilities 03.0.1. Capability Overview 03.1. Resource Limits 03.1.0. Limit-able Resource Overview 03.2. File Attributes 03.3. The chroot(1) Command

04. Required Modifications

04.0. Context Separation 04.1. Network Separation 04.2. The Chroot Barrier 04.3. Upper Bound for Caps 04.4. Resource Isolation 04.5. Filesystem XID Tagging

05. Additional Modifications

05.0. Context Flags 05.1. Context Capabilities 05.2. Context Accounting 05.3. Context Limits 05.4. Virtualization 05.5. Improved Security 05.6. Kernel Helper

06. Features and Bonus Material

06.0. Unification 06.1. Private Namespaces 06.2. The Linux-VServer Proc-FS 06.3. Token Bucket Extensions 06.4. Context Disk Limits 06.5. Per-Context Quota 06.6. The VRoot Proxy Device 06.7. Stealth

07. Linux-VServer Security

07.0. Secure Capabilities 07.1. The Chroot Barrier 07.2. Secure Device Nodes 07.3. Secure Proc-FS Entries

08. Field of Application

08.0. Administrative Separation 08.1. Service Separation 08.2. Enhancing Security 08.3. Easy Maintenance 08.4. Fail-over Scenarios 08.5. For Testing

09. Performance and Stability

09.0. Impact of Linux-VServer on the Host 09.1. Overhead inside a Context 09.2. Size of the Kernel Patch

10. Non Intel i386 Hardware

11. Linux Kernel Intro

11.0. Kernel and User Space 11.1. Linux Syscalls

12. Kernel Side Implementation

12.0. The Syscall Command Switch 12.1. Utilized Data Structures 12.1.0. The Context Data Structure 12.1.1. The Scheduler Command Data 12.1.2. Example Accounting: Sockets 12.1.3. Example Limits: Virtual Memory 12.1.4. Example Virtualization: Uptime

13. Future Directions

13.0. Hierarchical Contexts 13.1. Security Branch 13.2. Stealth Branch

14. Step by Step Examples

14.0. [E01] Linux Caps Example 14.1. [E02] Manipulating Linux Caps 14.2. [E03] CAP_MKNOD Example 14.3. [E11] Resource Limits via BASH 14.4. [E12] Example CPU Time Limit 14.5. [E13] Normal File without Attributes 14.6. [E14] Immutable File Attribute 14.7. [E15] Chroot Example 14.8. [E21] Process Isolation 14.9. [E22] Dual Context Isolation 14.10. [E23] Fake Init Process 14.11. [E24] Network Isolation 14.12. [E31] Context File Tagging 14.13. [E32] XID File Permissions 14.14. [E33] Context Flags 14.15. [E34] Context Capabilities 14.16. [E41] Context Accounting 14.17. [E42] Context Limits 14.18. [E43] Uptime Virtualization 14.19. [E44] ProcFS Guest Security 14.20. [E45] ProcFS Host Security 14.21. [XX] Not Included Yet

15. Help and References