Re: (forw) [conspire] Huge Nov. 5th Washington Post article on Linux security

Peter,

Compare this with jails: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html

How do BSD jails address letting two services talk to one another, in a limited way? For example, postfix wants to talk to dovecot's SASL implementation over a unix socket. The way this works for me at the moment (on Linux) is that one opens a socket in the other's chroot area, before chrooting into its own area. Because it was already open before chroot(2), it can continue using it.