git: Bring in DIRFS: A filesystem for VKERNELS

[Chris Turner]

late response.. catching up on my lists
hopefully will soon be up and running again after moving

On 09/04/13 19:16, Antonio Huete Jimenez wrote:
> commit 509bc517a3efdc2540ce5ca92d2ef4afec4e8b6d
> Author: Antonio Huete Jimenez <tuxillo at quantumachine.net>
> Date:   Wed Aug 22 14:53:18 2012 +0200
>
>      Bring in DIRFS: A filesystem for VKERNELS

whoa sweet!

>        - Any ideas?

thinking this might be safer if it was host-side
enablable/disablable e.g. probably not on by default -
all host-side resources to date have required host-side
enablement (e.g. network interface specified,
vdisk given, etc.)

though I know we suggest vkernels only for testing,
Someone who gets up and running quickly with network
enabled vkernels running 'for isolation'
and missing the fine print on this subtlety,
might be in for a nasty surprise if the vkernel gets
rooted, for example.. (though the extra clever attacker
could hijack the vkernel process for same access)

Maybe a host-side flag, for example '-d' or '-d /sub/dir'
to blanket-enable or enable via restricted subpath
could at least provide some barrier / failsafe...

if someone felt ambitious, they could also
look into setuid/chdir kinds of things as well,
while on the subject...

Hoping to contribute more than just blathering soon :D

Cheers,
- Chris