A process which is chrooted into failfs cannot open new files. It is limited to the set of filesystem file descriptors it already has open (presumably set up before the chroot or inherited into the process from some container runtime).

nesarkvechnep 21 minutes ago | parent | next [-]

They’ll do everything but adopt Capsicum. Shame.

▲

shevy-java 4 hours ago | parent | prev | next [-]

So basically more fine tuned jail controls.

I'd love if chrooting would become easier. In particular a requirement to have bash or a specific shell is annoying; imo a simple REPL should suffice already there. I wrote one that works years ago, need to look into what is all needed for a chroot (I always used bash for this but I'd also want to change to my own shell eventually).

	▲	rwmj 4 hours ago \| parent [-]
		We wanted capabilities[1]. Instead we get this over-complicated series of system calls with no design consistency that you have to use very carefully, else they can be bypassed (see the list of caveats on the failfs page). [1] https://en.wikipedia.org/wiki/Capability-based_security

▲

judetechdevs 4 hours ago | parent | prev [-]

[dead]