On Wed, 2009-01-07 at 08:55 -0800, ron minnich wrote: > The underlying assumption of motivation for this discussion is that > jailing (or whatever we want to call it) is somehow a good thing. > Given that every CPU we care about comes with virtualization hardware, > I just can't see the point of jails -- seems like an idea whose time > has gone, kind of like 8086 segments. > > If we give up on using RFNOMNT as a jailing mechanism, do the concerns > really make any sense?
Well, as was pointed out before -- not all hardware supports virtualization. And it would be a mistake to stick a virtualization layer into every bit of silicone. The discussion here is really about one kernel vs. many. Hardware not being able to run many gives you one constraint. Another issue is that many kernels don't share anything unless explicitly told so. A single kernel have access to everything and thus needs to be explicitly told when access to resources is NOT to be granted. Just two ways to think about it. Don't know which one is better. Thanks, Roman.
