-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Giovanni, | If a have a service running in a vserver, and this service get compromised by | an attacker, is the attacker confined to the vserver, so that he/she can't | compromise any of the other services (running in other vservers), and he/she | can't modify files outside the filesystem of the compromised vserver? A user inside the vserver has access to the filesystem and the processes inside the vserver. If your setup does not share any resources between more than one vserver, it is not possible for a user (attacker or legal user - doesn't matter) to access filesystem resources outside the guest, as long as you do not give special capabilities to the guest which enable it to access kernel devices directly. There might be the change that the process/resource isolation code of vserver itself has bugs - in this case you will obvioulsy loose this security. | Is a vserver context more secure than a chroot jail? AFAIK a jail hides the filesystem but not processes - so I would give a yes at least regarding this issue. Oliver - -- Protect your environment - close windows and adopt a penguin! PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF 8168 CAB7 B0DD 3985 1721 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFILLb6yrew3TmFFyERAnSsAJ98cf3POkghS/uIh2/U+g+u2fISUwCcDPWx /pNLbMdGnxgA57TDLvvJDKU= =TQNT -----END PGP SIGNATURE-----