<html><head></head><body>Yep. The chroot provides only what can be run and cgroups controls the resources.<br>
<br>
I don't write directly into sys tree (usually). Sysctl.conf is my preferred method. Cgroups has conf file for everything, /etc/cgconfig.conf. The man page cgconfig.conf has multiple examples.<br><br><div class="gmail_quote">On September 18, 2017 12:01:01 AM EDT, Steve Litt <slitt@troubleshooters.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On Sun, 17 Sep 2017 17:32:24 -0400<br />Jim Kinney <jim.kinney@gmail.com> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br /> On September 17, 2017 5:11:38 PM EDT, Steve Litt<br /> <slitt@troubleshooters.com> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">On Sat, 16 Sep 2017 22:21:32 -0400<br />Jim Kinney <jim.kinney@gmail.com> wrote:<br /><br /> <br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> <br /> Chroots work well. Add cgroups and its rather locked down. <br /></blockquote><br />What part do cgroups add to the mix?<br /> <br />SteveT<br /></blockquote></blockquote><br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Best explanation is wikipedia<br /> <br /> <a href="https://en.m.wikipedia.org/wiki/Cgroups">https://en.m.wikipedia.org/wiki/Cgroups</a><br /> <br /> Short answer: it's how you set usage limits on a process.<br /></blockquote><br />So if I understand you correctly, cgroups doesn't directly enhance<br />security, but instead "locks down" how much of certain resources a<br />process and any of its spawned processes can use. If I'm not mistaken,<br />the chroot enhances security. That sound right?<br /><br />When you control cgroups, do you interact with the /sys/fs/cgroup tree?<br /><br />Thanks,<br /> <br />SteveT<br /><br />Steve Litt<br />September 2017 featured book: Manager's Guide to Technical<br />Troubleshooting Brand new, second edition<br /><a href="http://www.troubleshooters.com/mgr">http://www.troubleshooters.com/mgr</a><br /><hr /><br />Ale mailing list<br />Ale@ale.org<br /><a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a><br />See JOBS, ANNOUNCE and SCHOOLS lists at<br /><a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. All tyopes are thumb related and reflect authenticity.</body></html>