Kevin Reid: create for the sake of categorization; copied from http://www.eros-os.org/pipermail/cap-talk/2004-December/002546.html

2007-11-02T03:33:14Z

create for the sake of categorization; copied from http://www.eros-os.org/pipermail/cap-talk/2004-December/002546.html

New page

[http://www.cs.jhu.edu/~seaborn/plash/plash.html Plash] is
a Unix shell which lets you run Unix programs with access only
to the files and directories they need to run. Programs are given
access to files which were passed as command line arguments.

In order to implement this, the filesystem is virtualised. Each
process can have its own namespace — its own root directory — which
can contain a subset of your files.

This is implemented by modifying GNU libc and replacing the system
calls that use filenames. For example, <code>open()</code> is changed so that it
sends a message to a file server via a socket. If the request is
successful, the server sends the client a file descriptor via the
socket as a result. Processes are run as the user ‘<code>nobody</code>’, and in a
chroot jail, so that they can't access any files using the usual
system calls, and must go through the file server instead. This
approach doesn't require modifying the kernel at all.

[[Category:Command lines]]

Plash - Revision history

Kevin Reid: create for the sake of categorization; copied from http://www.eros-os.org/pipermail/cap-talk/2004-December/002546.html