Subject: Re: [vserver] Single application per VServer ?
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 20 Jan 2010 03:10:36 +0100

On Tue, Jan 19, 2010 at 05:00:46PM -0800, Kyle Bader wrote:
> What you've done is create a kernel level context isolating that
> specific process.  For eample if you wanted to kill the ssh process
> then you could run:
>  vcontext --migrate --xid $context bash
> 
> This will create an interactive shell and migrate the shell process to
> kernel context $context.  From there you could use said shell to
> manipulate other processes in the same context including issuing a
> 'kill $pid'.  

> If I've botched this in anyway please correct me Herbert

nah, basically fine, but you can use vkill to kill
processes inside a context from the host ...

best,
Herbert

> :P
> 
> On 1/19/10, Corey Wright <undefined@pobox.com> wrote:
> > On Tue, 19 Jan 2010 16:41:37 +0100
> > Shinkan <shinkan@gmail.com> wrote:
> >
> >> 2010/1/19 Shinkan <shinkan@gmail.com>
> >>
> >> >
> >> >
> >> > 2010/1/19 Corey Wright <undefined@pobox.com>
> >> >
> >> >
> >> >> like an application-specific chroot, but with the added functionality
> >> >> of linux-vserver?
> >> >>
> >> >
> >> > Hi Corey,
> >> >
> >> > Thanks for your try.
> >> > That's what I need yeah, "a (nearly) bullet proof chroot" to launch one
> >> > service.
> >> > And I want to use VServer as my "bullet proof chroot".
> >> >
> >> >  i think vcontext.
> >> >>
> >> >
> >> > I'll Google for it.
> >> >
> >>
> >>
> >> *crying*
> >> That's one of the most un-successful search I've ever made.
> >
> > yeah, there's not much on vcontext, which is why i said you might want to
> > go with more standard linux-vserver usage ("vserver <name> start") and
> > heavily minimize/customize the vserver.
> >
> > if you are trying to reduce filesystem usage, then look into unification.
> > if you are doing this to reduce attack surface (less tools to leverage once
> > an attacker compromises the lone application).
> >
> >> I tried vcontext --create --xid 444 -- /etc/init.d/sshd start, and it
> >> seemed to work, but I didn't get what was done at all.
> >
> > i only know to recommend:
> >  * vcontext --help
> >
> > to see how "vserver <name> start" leverages vcontext:
> >
> >  * less /usr/sbin/vserver
> >  * less /usr/lib/util-vserver/vserver.start
> >  * less /usr/lib/util-vserver/vserver.functions
> >
> > yes, "use the source, luke" is probably not you were wanting.
> >
> > or jump on irc and ask there, as the linux-vserver irc channel has always
> > been most responsive and helpful to me.  (and then document whatever they
> > tell you on the wiki. ;-)
> >
> >> Then, to be sure, I've done /etc/init.d/sshd stop (which worked), BUT I'm
> >> still able to "ssh localhost" ??!
> >> I can't find any ssh in "ps aux".
> >
> > try "vps" instead of "ps" to list processes running within vservers.
> >
> > corey
> >
> >> I really think like I don't understand what happened, and what vcontext
> >> do.
> >>
> >> --
> >> Pierre.
> >> "Sometimes when I'm talking, my words can't keep up with my thoughts. I
> >> wonder why we think faster than we speak. Probably so we can think
> >> twice." - Bill Watterson
> >>
> > --
> > undefined@pobox.com
> >
> 
> -- 
> Sent from my mobile device
> 
> 
> Kyle