Re: Using fs views to isolate untrusted processes: I need an assistant architect in the USA for Phase I of a DARPA funded linux kernel project

[Kyle Moffett]

On Aug 26, 2004, at 00:29, viro@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx wrote:
> Files and directories are not different in that respect - the only 
> overhead
> is price of hash lookup when crossing the binding in either case.  1000
> bindings shouldn't be a problem - it's 3--5 per hash chain.  Wrt 
> memory,
> it's one struct vfsmount allocated per binding - IOW, about 80Kb total
> for 1000 of those.

Where would I increase the hash size if I wanted to increase the number
of bindings by an order of magnitude or so?  I'm very interested in
pursuing this possibility, because when combined with the procedure I
described earlier, plus a little bit of extra work with capabilities 
and such
it's very easy to build incredibly flexible and basically indestructible
chroot environments with not much code.

Cheers,
Kyle Moffett

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCM/CS/IT/U d- s++: a17 C++++>$ UB/L/X/*++++(+)>$ P+++(++++)>$
L++++(+++) E W++(+) N+++(++) o? K? w--- O? M++ V? PS+() PE+(-) Y+
PGP+++ t+(+++) 5 X R? tv-(--) b++++(++) DI+ D+ G e->++++$ h!*()>++$ r  
!y?(-)
------END GEEK CODE BLOCK------


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/