On Tue, Jan 19, 2010 at 05:00:46PM -0800, Kyle Bader wrote: > What you've done is create a kernel level context isolating that > specific process. For eample if you wanted to kill the ssh process > then you could run: > vcontext --migrate --xid $context bash > > This will create an interactive shell and migrate the shell process to > kernel context $context. From there you could use said shell to > manipulate other processes in the same context including issuing a > 'kill $pid'. > If I've botched this in anyway please correct me Herbert nah, basically fine, but you can use vkill to kill processes inside a context from the host ... best, Herbert > :P > > On 1/19/10, Corey Wright <undefined@pobox.com> wrote: > > On Tue, 19 Jan 2010 16:41:37 +0100 > > Shinkan <shinkan@gmail.com> wrote: > > > >> 2010/1/19 Shinkan <shinkan@gmail.com> > >> > >> > > >> > > >> > 2010/1/19 Corey Wright <undefined@pobox.com> > >> > > >> > > >> >> like an application-specific chroot, but with the added functionality > >> >> of linux-vserver? > >> >> > >> > > >> > Hi Corey, > >> > > >> > Thanks for your try. > >> > That's what I need yeah, "a (nearly) bullet proof chroot" to launch one > >> > service. > >> > And I want to use VServer as my "bullet proof chroot". > >> > > >> > i think vcontext. > >> >> > >> > > >> > I'll Google for it. > >> > > >> > >> > >> *crying* > >> That's one of the most un-successful search I've ever made. > > > > yeah, there's not much on vcontext, which is why i said you might want to > > go with more standard linux-vserver usage ("vserver <name> start") and > > heavily minimize/customize the vserver. > > > > if you are trying to reduce filesystem usage, then look into unification. > > if you are doing this to reduce attack surface (less tools to leverage once > > an attacker compromises the lone application). > > > >> I tried vcontext --create --xid 444 -- /etc/init.d/sshd start, and it > >> seemed to work, but I didn't get what was done at all. > > > > i only know to recommend: > > * vcontext --help > > > > to see how "vserver <name> start" leverages vcontext: > > > > * less /usr/sbin/vserver > > * less /usr/lib/util-vserver/vserver.start > > * less /usr/lib/util-vserver/vserver.functions > > > > yes, "use the source, luke" is probably not you were wanting. > > > > or jump on irc and ask there, as the linux-vserver irc channel has always > > been most responsive and helpful to me. (and then document whatever they > > tell you on the wiki. ;-) > > > >> Then, to be sure, I've done /etc/init.d/sshd stop (which worked), BUT I'm > >> still able to "ssh localhost" ??! > >> I can't find any ssh in "ps aux". > > > > try "vps" instead of "ps" to list processes running within vservers. > > > > corey > > > >> I really think like I don't understand what happened, and what vcontext > >> do. > >> > >> -- > >> Pierre. > >> "Sometimes when I'm talking, my words can't keep up with my thoughts. I > >> wonder why we think faster than we speak. Probably so we can think > >> twice." - Bill Watterson > >> > > -- > > undefined@pobox.com > > > > -- > Sent from my mobile device > > > Kyle