Hacker News Reader

So basically more fine tuned jail controls.

I'd love if chrooting would become easier. In particular a requirement to have bash or a specific shell is annoying; imo a simple REPL should suffice already there. I wrote one that works years ago, need to look into what is all needed for a chroot (I always used bash for this but I'd also want to change to my own shell eventually).

View on HN

We wanted capabilities[1]. Instead we get this over-complicated series of system calls with no design consistency that you have to use very carefully, else they can be bypassed (see the list of caveats on the failfs page).

[1] https://en.wikipedia.org/wiki/Capability-based_security

Capability-based security might be the bees knees, but how would one retrofit it into an existing kernel without breaking backwards compatibility?

Reply on news.ycombinator.com