RE: Chroot jails

["Wall, Kevin" <Kevin.Wall () qwest com>]

Antoine Martin writes...

> > Wondered if people could give me their opinions on chroot jails
> > > AFAIK, chroot on linux is fundamentally insecure - look for the
> > > 'chroot-again' flaw.
> > > Last time I checked it still worked and allowed to escape.
> A chrooted jail without dropping privileges is vain anyway.
> Indeed. Which is why I prefer:
>   http://www.suse.de/~marc/compartment.html
> Unlike chroot you can drop privileges in one swoop.
> It deserves to be mentioned in this thread.

'compartment' looks like like a separate executable, typically
invoked at the shell level.

Is there anything like this in SuSE or other *nix variations that
does something similar to this in a single, atomic system call?
---
Kevin W. Wall           Qwest Information Technology, Inc.
Kevin.Wall () qwest com Phone: 614.215.4788
"The reason you have people breaking into your software all 
over the place is because your software sucks..."
 -- Former whitehouse cybersecurity advisor, Richard Clarke,
    at eWeek Security Summit