From owner-freebsd-arch@FreeBSD.ORG Wed Jun 25 07:52:37 2003 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 02ED337B401 for ; Wed, 25 Jun 2003 07:52:37 -0700 (PDT) Received: from demos.su (mx.demos.su [194.87.0.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id 94B8D43FEA for ; Wed, 25 Jun 2003 07:52:35 -0700 (PDT) (envelope-from mitya@fling-wing.demos.su) Received: from [194.87.5.69] (HELO fling-wing.demos.su) by demos.su (CommuniGate Pro SMTP 4.1b7/D) with ESMTP-TLS id 78046347; Wed, 25 Jun 2003 18:52:34 +0400 Received: from fling-wing.demos.su (localhost [127.0.0.1]) by fling-wing.demos.su (8.12.9/8.12.6) with ESMTP id h5PEqY5R029779; Wed, 25 Jun 2003 18:52:34 +0400 (MSD) (envelope-from mitya@fling-wing.demos.su) Received: (from mitya@localhost) by fling-wing.demos.su (8.12.9/8.12.6/Submit) id h5PEqXoY029778; Wed, 25 Jun 2003 18:52:33 +0400 (MSD) Date: Wed, 25 Jun 2003 18:52:33 +0400 From: Dmitry Sivachenko To: Pawel Jakub Dawidek Message-ID: <20030625145233.GA28322@fling-wing.demos.su> References: <20030624164602.GW7587@garage.freebsd.pl> <20030625135106.GA19868@fling-wing.demos.su> <20030625140518.GA23435@fling-wing.demos.su> <20030625144849.GJ7587@garage.freebsd.pl> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <20030625144849.GJ7587@garage.freebsd.pl> WWW-Home-Page: http://mitya.pp.ru/ X-PGP-Key: http://mitya.pp.ru/mitya.asc User-Agent: Mutt/1.5.4i cc: freebsd-arch@freebsd.org Subject: Re: Jailed sysvipc implementation. X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jun 2003 14:52:37 -0000 On Wed, Jun 25, 2003 at 04:48:49PM +0200, Pawel Jakub Dawidek wrote: > On Wed, Jun 25, 2003 at 06:05:18PM +0400, Dmitry Sivachenko wrote: > +> > > Some time ago I've implemented private memory zones for IPC mechism. > +> > > Every jail and main host got its own memory for IPC operations. > +> > > It was implemented for FreeBSD 4.x. Avaliable at: > +> > > > +> > > http://garage.freebsd.pl/privipc.tbz > +> > > http://garage.freebsd.pl/privipc.README > +> > > +> > I think it would be better to add checks to disallow the use of IPC > +> > primitives created in one jail from another. > +> > Thus we will avoid allocating separate segments of kernel memory for > +> > each jail. > +> > > +> > It could be trivially achieved by adding another field to struct ipc_perm, > +> > but Robert Watson said he knows another way of doing this without > +> > breaking ABI (if I understood him right). > +> > > +> > +> Please look at his patch: > +> > +> http://www.watson.org/~robert/freebsd/mac_sysvipc.diff > +> > +> It does slightly different things, but we could borrow from it. > > But you got still *one* memory zones for every jail and main host. Yes, that is exactly what I want. This is similar to separate IP stack for each jail: this is more powerful solution, but more expensive (uses more kernel memory). Jail is not a true virtual machine. Let's keep it a *light* virtual machine replacement, with single IP stack, one memory zones for all jails and host, etc. > And I want to separate them. > Then you should join Marco Zec and contribute to his project. Jail will hardly become a true virtual machine.