Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2013-05-05 Thread Vincent Bernat
❦ 4 novembre 2012 02:35 CET, Roger Leigh rle...@codelibre.net : These three are now also done. Definable keys: unshare.net unshare.sysvipc unshare.sysvsem unshare.uts Hi Roger! What about unshare.pid? Do you want me to open a separate bug about this one or could we just reopen #637870?

Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2013-05-05 Thread Roger Leigh
On Sun, May 05, 2013 at 07:28:34PM +0200, Vincent Bernat wrote: ❦ 4 novembre 2012 02:35 CET, Roger Leigh rle...@codelibre.net : These three are now also done. Definable keys: unshare.net unshare.sysvipc unshare.sysvsem unshare.uts Hi Roger! What about unshare.pid? Do you

Bug#637870: Provide more isolation than just chroot

2012-11-03 Thread Roger Leigh
On Mon, Aug 15, 2011 at 12:46:31PM +0200, Vincent Bernat wrote: Recent Linux kernels allow more advanced isolation than just chrooting. From clone(2) manpage, those possibilities exist: - CLONE_NEWPID: new PID namespace, including the fact that when the initial process dies (in case of

Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2012-11-03 Thread Roger Leigh
On Sat, Nov 03, 2012 at 02:03:33PM +, Roger Leigh wrote: On Mon, Aug 15, 2011 at 12:46:31PM +0200, Vincent Bernat wrote: Recent Linux kernels allow more advanced isolation than just chrooting. From clone(2) manpage, those possibilities exist: - CLONE_NEWPID: new PID namespace,

Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Vincent Bernat
Package: schroot Version: 1.4.23-1 Severity: wishlist -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi! Recent Linux kernels allow more advanced isolation than just chrooting. From clone(2) manpage, those possibilities exist: - CLONE_NEWPID: new PID namespace, including the fact that when the

Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Roger Leigh
On Mon, Aug 15, 2011 at 12:46:31PM +0200, Vincent Bernat wrote: Recent Linux kernels allow more advanced isolation than just chrooting. From clone(2) manpage, those possibilities exist: - CLONE_NEWPID: new PID namespace, including the fact that when the initial process dies (in case of

Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Vincent Bernat
OoO En ce début d'après-midi ensoleillé du lundi 15 août 2011, vers 15:18, Roger Leigh rle...@codelibre.net disait : The main problem preventing its use is the current architecture of schroot, particularly when using sessions. When a session is created, it's created by one schroot

Bug#637870: [buildd-tools-devel] Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Vincent Bernat
OoO Vers la fin de l'après-midi du lundi 15 août 2011, vers 16:49, je disais: The main problem preventing its use is the current architecture of schroot, particularly when using sessions. When a session is created, it's created by one schroot invocation, used in a separate invocation and

Bug#637870: [buildd-tools-devel] Bug#637870: Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Roger Leigh
On Mon, Aug 15, 2011 at 04:51:48PM +0200, Vincent Bernat wrote: OoO Vers la fin de l'après-midi du lundi 15 août 2011, vers 16:49, je disais: The main problem preventing its use is the current architecture of schroot, particularly when using sessions. When a session is created, it's

Bug#637870: [buildd-tools-devel] Bug#637870: Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Vincent Bernat
OoO Lors de la soirée naissante du lundi 15 août 2011, vers 17:23, Roger Leigh rle...@codelibre.net disait : % ls /proc/self/ns ipc net uts There's no mnt namespace here, which might be an issue. This is with Linux 3.0.0. Maybe it's not supported in /proc yet? Yes, no mnt, no pid. It

Bug#637870: [buildd-tools-devel] Bug#637870: Bug#637870: Bug#637870: Provide more isolation than just chroot

2011-08-15 Thread Roger Leigh
On Mon, Aug 15, 2011 at 06:00:00PM +0200, Vincent Bernat wrote: OoO Lors de la soirée naissante du lundi 15 août 2011, vers 17:23, Roger Leigh rle...@codelibre.net disait : % ls /proc/self/ns ipc net uts There's no mnt namespace here, which might be an issue. This is with Linux