I had been wanting this functionality myself, but for some reason it never found its way into the stock kernel. I looked around, started coding, looked some more, coded some more, looked some more until I found this:
http://kerneltrap.org/node/3823 I suppose the reason it wasn't applied is lack of good IPv6 support. It is perhaps about what I was looking for, but a slightly different method. My idea was to cause no disturbance to the normal security chain, and so maintain jails in the following manner (remember, the sys_jail call is trusted) 1. Add an additional check to path_lookup (actually, a functioned called by path_lookup) to check for jail roots in addition to normal chroots. 2. Lockdown process visibility to only processes in the same jail. 3. Lockdown kill/ptrace/setpriority to processes in the same jail. 4. Lockdown capabilities to a restricted set that prevents novel means of breaking the jail. 5. Restrict binding to one IPv4 and one IPv6 address (squash bind to all to bind to that). All of this is done in front of the normal security mechansim, so that some non-default security module will not accidentally break this. I provided compatability for exactly the BSD jail(2) call, but did it without breaking programs that depend on chroot escapes working (there are a few). I am currently about a third of the way to completion. This means that I will finish unless some other mechanism is provided before I do. I personally don't care if my patch is used (if released), but I want this functionality. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
