Re: RFC: jail functionality

[Stephen Smalley <sds@xxxxxxxxxxxxx>]

On Thu, 2005-06-30 at 09:19 -0400, Colin Walters wrote:
> But you should be aware that for a lot of the zone use cases, resource
> management is very important, and SELinux doesn't provide that.  You
> mention CKRM, but that's a whole other kernel patch.  Xen definitely
> seems to be the approach that's winning here.

IMHO, CKRM should be integrated with SELinux to allow policy control
over resource management.

For strict isolation (which does seem to be the theme of jail) as well
as complete transparency of that isolation, virtualization make sense.
But for controlled sharing, you will ultimately need OS-level controls.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.