Linux-VServer-Paper: Difference between revisions

From Linix VServer
Jump to navigationJump to search
(Restored content from Wayback Machine)
 
(No difference)

Latest revision as of 22:12, 10 November 2025

Linux-VServer Technology[edit]

Paper (C)2004 Herbert Pötzl

00. Abstract[edit]

01. Introduction[edit]

02. The Concept[edit]

03. Existing Infrastructure[edit]

03.0. Linux Capability System 03.0.0. POSIX Capabilities 03.0.1. Capability Overview 03.1. Resource Limits 03.1.0. Limit-able Resource Overview 03.2. File Attributes 03.3. The chroot(1) Command

04. Required Modifications[edit]

04.0. Context Separation 04.1. Network Separation 04.2. The Chroot Barrier 04.3. Upper Bound for Caps 04.4. Resource Isolation 04.5. Filesystem XID Tagging

05. Additional Modifications[edit]

05.0. Context Flags 05.1. Context Capabilities 05.2. Context Accounting 05.3. Context Limits 05.4. Virtualization 05.5. Improved Security 05.6. Kernel Helper

06. Features and Bonus Material[edit]

06.0. Unification 06.1. Private Namespaces 06.2. The Linux-VServer Proc-FS 06.3. Token Bucket Extensions 06.4. Context Disk Limits 06.5. Per-Context Quota 06.6. The VRoot Proxy Device 06.7. Stealth

07. Linux-VServer Security[edit]

07.0. Secure Capabilities 07.1. The Chroot Barrier 07.2. Secure Device Nodes 07.3. Secure Proc-FS Entries

08. Field of Application[edit]

08.0. Administrative Separation 08.1. Service Separation 08.2. Enhancing Security 08.3. Easy Maintenance 08.4. Fail-over Scenarios 08.5. For Testing

09. Performance and Stability[edit]

09.0. Impact of Linux-VServer on the Host 09.1. Overhead inside a Context 09.2. Size of the Kernel Patch

10. Non Intel i386 Hardware[edit]

11. Linux Kernel Intro[edit]

11.0. Kernel and User Space 11.1. Linux Syscalls

12. Kernel Side Implementation[edit]

12.0. The Syscall Command Switch 12.1. Utilized Data Structures 12.1.0. The Context Data Structure 12.1.1. The Scheduler Command Data 12.1.2. Example Accounting: Sockets 12.1.3. Example Limits: Virtual Memory 12.1.4. Example Virtualization: Uptime

13. Future Directions[edit]

13.0. Hierarchical Contexts 13.1. Security Branch 13.2. Stealth Branch

14. Step by Step Examples[edit]

14.0. [E01] Linux Caps Example 14.1. [E02] Manipulating Linux Caps 14.2. [E03] CAP_MKNOD Example 14.3. [E11] Resource Limits via BASH 14.4. [E12] Example CPU Time Limit 14.5. [E13] Normal File without Attributes 14.6. [E14] Immutable File Attribute 14.7. [E15] Chroot Example 14.8. [E21] Process Isolation 14.9. [E22] Dual Context Isolation 14.10. [E23] Fake Init Process 14.11. [E24] Network Isolation 14.12. [E31] Context File Tagging 14.13. [E32] XID File Permissions 14.14. [E33] Context Flags 14.15. [E34] Context Capabilities 14.16. [E41] Context Accounting 14.17. [E42] Context Limits 14.18. [E43] Uptime Virtualization 14.19. [E44] ProcFS Guest Security 14.20. [E45] ProcFS Host Security 14.21. [XX] Not Included Yet

15. Help and References[edit]