Jailed sysvipc implementation.

[Pawel Jakub Dawidek]

On Wed, Jun 25, 2003 at 06:21:30PM +0700, Max Khon wrote:
+> > Some time ago I've implemented private memory zones for IPC mechism.
+> > Every jail and main host got its own memory for IPC operations.
+> > It was implemented for FreeBSD 4.x. Avaliable at:
+> > 
+> > 	http://garage.freebsd.pl/privipc.tbz
+> > 	http://garage.freebsd.pl/privipc.README
+> > 
+> > I want to port this to FreeBSD 5.x, but with many improvements.
+> > Because of that there are few things to talk about and I'm curious if
+> > anyone will be interested in answering my questions and at the end
+> > commiting this to -CURRENT.
+> > 
+> > Patch will not be a "fast hack" so the best way will be commiting this
+> > in parts. I got already working sysvipv_msg mechanism.
+> > 
+> > So if anyone is interested in, please inform me and I'll ask my
+> > questions and I'll send also what I got now.
+> 
+> I'm interested in reviewing and committing this stuff

Thanks.

So first of all, I implemented something like allocate-on-demand.
Memory zones are allocated only if IPC syscall will be called
from inside of jail. This is the best way, I think, because:
1. We don't allocate memory if this isn't needed.
2. We don't have to fight with locking prisons list when loading
   IPC as kld module (allocating memory when lock is holded, ehh).

I'm also proposing to create mirror of those values:

	security.jail.ipc.msgmax
	security.jail.ipc.msgmni
	security.jail.ipc.msgmnb
	security.jail.ipc.msgtql
	security.jail.ipc.msgssz
	security.jail.ipc.msgseg

They will be always read-write and used to calculate memory that
will be allocated for newly created jails.

Is everything what I'm saying sounds reasonable I'll send patch
for sysvipc_msg.

-- 
Pawel Jakub Dawidek                       pawel at dawidek.net
UNIX Systems Programmer/Administrator     http://garage.freebsd.pl
Am I Evil? Yes, I Am!                     http://cerber.sourceforge.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 305 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-arch/attachments/20030625/3b32e1fe/attachment.bin