<div>Hi Norbert.<br></div><div><br></div><div>> You need to define what you are willing to risk.</div><div><br></div><div><br></div><div><br></div><div>> Chroot and jail are similar and basically isolate just on the filesystem layer.<br>
</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br><div class="gmail_quote">2012/1/31 Norbert Hartl <span dir="ltr"><<a href="mailto:norbert@hartl.name">norbert@hartl.name</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">You need to define what you are willing to risk.</div></blockquote><div><br></div><div>
Yes right, I just have interesting about jails, but just now I do not have a real scenario, I'm the only user in my hosting.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"> Then you need to define your sandbox. Chroot and jail are similar and basically isolate just on the filesystem layer. Access to other resources is not easy possible because inside the jail there is no default access. But you give away control over the jailed environment. A malicious person can still bring his own binaries and abuse the network.</div>
</blockquote><div><br></div><div>As far I know, jail are more like a OS virtual machine, becouse it be able to control other resource not only file system, like your proccess and network configurations, see See: <a href="http://en.wikipedia.org/wiki/FreeBSD_jail">http://en.wikipedia.org/wiki/FreeBSD_jail</a>.</div>
<div>But not controled the cpu and ram utilization, and then yes a user can be abusing of them and network. But for control the network usage i think that the best approach is a firewall external to the jails (and good switch :).</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>If you are looking for better isolation and you are not to eager to use freeBSD then have a look at linux containers LXC [1]. Anyway you give away access to resources like the network.</div>
</div></blockquote><div><br></div><div>Thanks for the data, I check lxc that mu hosting is a Linux box. </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div>If you need better isolation then you would need to get rid of the primitives in the vm. Probably it is not to hard to get rid of system accessing primitives after the image has been loaded and changes etc. are disabled. I think Igor proposed something with an irreversible primitive call that disables some primitives.</div>
</div></blockquote><div><br></div><div>Very advance for my, but sounds like the better solution.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">
<div><br></div><div>my 2 cents,</div><div><br></div><div>Norbert</div></div></blockquote><div><br></div><div>Thanks.</div><div>Gastón.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><br></div><div>[1] <a href="http://lxc.sourceforge.net/" target="_blank">http://lxc.sourceforge.net/</a></div><div><br><div><div>Am 31.01.2012 um 13:36 schrieb Gastón Dall' Oglio:</div>
<div><div class="h5"><br><blockquote type="cite"><div>Ah ok, I never :) But I have curiosity for this tecnology of jails in FreeBSD for hosted seaside instances.</div><div>Regards.</div><br><div class="gmail_quote">2012/1/28 laurent laffont <span dir="ltr"><<a href="mailto:laurent.laffont@gmail.com" target="_blank">laurent.laffont@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_quote"><div>2012/1/28 Gastón Dall' Oglio <span dir="ltr"><<a href="mailto:gaston.dalloglio@gmail.com" target="_blank">gaston.dalloglio@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>Laurent, just for curiosity, in FreeBSD I know that existing Jails, do you use FreeBSD jails?</div><div><a href="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html" target="_blank">http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html</a></div>
</blockquote><div><br></div></div><div>No. I have not booted a FreeBSD for years ..... </div><span><font color="#888888"><div><br></div><div>Laurent</div></font></span><div><div><div><br></div><div>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div>
<br><div class="gmail_quote">2012/1/25 laurent laffont <span dir="ltr"><<a href="mailto:laurent.laffont@gmail.com" target="_blank">laurent.laffont@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_quote"><div><div>On Tue, Jan 24, 2012 at 2:42 PM, Nick Ager <span dir="ltr"><<a href="mailto:nick.ager@gmail.com" target="_blank">nick.ager@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_quote"><div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ce n'est pas si facile que ça.<br>
<br>
(1 perform: ('cla', 'ss') asSymbol) environment at: ('Comp', 'iler') asSymbol<br>
<br>
And again, you give the web app user the full rights of the OS user<br>
that runs the image. Deleting the code that owned you after the<br>
session times out doesn't solve a thing once you've been owned. It<br>
also doesn't help if two users at the same time want to work on a<br>
class named 'Test' or 'MyClass' or 'Example'.<br></blockquote><div><br></div></div><div>you could always use chroot [1] and isolate each web app user's environment.</div><div><br></div><div>[1] <a href="http://en.wikipedia.org/wiki/Chroot" target="_blank">http://en.wikipedia.org/wiki/Chroot</a></div>
</div>
<br></blockquote><div><br></div></div></div><div>On SmallHarbour we use a secured VM so each image run in a "jail" and cannot access filesystem out of its root dir. There's some (ugly / hacky) automated image deployment. If someone want to play with I can help.</div>
<span><font color="#888888">
<div><br></div><div>Laurent</div></font></span><div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">_______________________________________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org" target="_blank">seaside@lists.squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
<br></blockquote></div></div><br>
<br>_______________________________________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org" target="_blank">seaside@lists.squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
<br></blockquote></div><br>
</div></div><br>_______________________________________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org" target="_blank">seaside@lists.squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
<br></blockquote></div></div></div><br>
<br>_______________________________________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org" target="_blank">seaside@lists.squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
<br></blockquote></div><br>
_______________________________________________<br>seaside mailing list<br><a href="mailto:seaside@lists.squeakfoundation.org" target="_blank">seaside@lists.squeakfoundation.org</a><br><a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
</blockquote></div></div></div><br></div></div><br>_______________________________________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org">seaside@lists.squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" target="_blank">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a><br>
<br></blockquote></div><br>