cvs commit: src/sys/kern kern_proc.c

[David Cuthbert]

Matthew Dillon wrote:
    I think the idea has merit, it just isn't being taken far enough.  What
    we really want here is a 'virtual machine'.  The current jail subsystem
    is still sharing the same kernel resources, data space, and code,
    and thus could still panic the entire system and could still create 
    cross-jail security issues.
I'm not comfortable with the idea of substituting VMs for jails.  While 
they're not entirely orthogonal (a VM could be viewed as a jail with 
more separation), I have distinct uses for jails and VMs.

Not so sure that a VM would help with panics.  I think you'll just end 
up swapping one set of panic-causing bugs for another.

Dave