We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Linux-VServer Technology

Paper (C)2004 Herbert P÷tzl

00. Abstract

01. Introduction

02. The Concept

03. Existing Infrastructure

03.0. Linux Capability System
03.0.0. POSIX Capabilities
03.0.1. Capability Overview
03.1. Resource Limits
03.1.0. Limit-able Resource Overview
03.2. File Attributes
03.3. The chroot(1) Command

04. Required Modifications

04.0. Context Separation
04.1. Network Separation
04.2. The Chroot Barrier
04.3. Upper Bound for Caps
04.4. Resource Isolation
04.5. Filesystem XID Tagging

05. Additional Modifications

05.0. Context Flags
05.1. Context Capabilities
05.2. Context Accounting
05.3. Context Limits
05.4. Virtualization
05.5. Improved Security
05.6. Kernel Helper

06. Features and Bonus Material

06.0. Unification
06.1. Private Namespaces
06.2. The Linux-VServer Proc-FS
06.3. Token Bucket Extensions
06.4. Context Disk Limits
06.5. Per-Context Quota
06.6. The VRoot Proxy Device
06.7. Stealth

07. Linux-VServer Security

07.0. Secure Capabilities
07.1. The Chroot Barrier
07.2. Secure Device Nodes
07.3. Secure Proc-FS Entries

08. Field of Application

08.0. Administrative Separation
08.1. Service Separation
08.2. Enhancing Security
08.3. Easy Maintenance
08.4. Fail-over Scenarios
08.5. For Testing

09. Performance and Stability

09.0. Impact of Linux-VServer on the Host
09.1. Overhead inside a Context
09.2. Size of the Kernel Patch

10. Non Intel i386 Hardware

11. Linux Kernel Intro

11.0. Kernel and User Space
11.1. Linux Syscalls

12. Kernel Side Implementation

12.0. The Syscall Command Switch
12.1. Utilized Data Structures
12.1.0. The Context Data Structure
12.1.1. The Scheduler Command Data
12.1.2. Example Accounting: Sockets
12.1.3. Example Limits: Virtual Memory
12.1.4. Example Virtualization: Uptime

13. Future Directions

13.0. Hierarchical Contexts
13.1. Security Branch
13.2. Stealth Branch

14. Step by Step Examples

14.0. [E01] Linux Caps Example
14.1. [E02] Manipulating Linux Caps
14.2. [E03] CAP_MKNOD Example
14.3. [E11] Resource Limits via BASH
14.4. [E12] Example CPU Time Limit
14.5. [E13] Normal File without Attributes
14.6. [E14] Immutable File Attribute
14.7. [E15] Chroot Example
14.8. [E21] Process Isolation
14.9. [E22] Dual Context Isolation
14.10. [E23] Fake Init Process
14.11. [E24] Network Isolation
14.12. [E31] Context File Tagging
14.13. [E32] XID File Permissions
14.14. [E33] Context Flags
14.15. [E34] Context Capabilities
14.16. [E41] Context Accounting
14.17. [E42] Context Limits
14.18. [E43] Uptime Virtualization
14.19. [E44] ProcFS Guest Security
14.20. [E45] ProcFS Host Security
14.21. [XX] Not Included Yet

15. Help and References