3 ms·
When you create a child process, you can clone your namespace or you can construct a new one for the child. (Disclosure: I wrote the doc linked above.)
by abarth 9y ago
When you create a child process, you can clone your namespace or you can construct a new one for the child.
(Disclosure: I wrote the doc linked above.)
- nickpsecurity 9y agoSomeone told me there were ex-devs of QNX microkernel doing Google's. Is that true?
- bitmapbrother 9y agoNot sure about QNX, but the lead developers are ex Be, Danger, Palm and Apple.
- nickpsecurity 9y agoThanks for that clarification. That is an interesting mix.
- bitmapbrother 9y agoAs for QNX, one of its founders, Dan Dodge, is now at Apple.
- stefankomatsu 9y agoThanks. How about virtualization? Using an example from the doc, if your child process accesses "/dev/class/framebuffer", can you intercept its communications? Can a process create a custom sandbox and run, say, AppMgr with limited permission to limit the permissions of all apps it manages?
- abarth 9y ago> Using an example from the doc, if your child process accesses "/dev/class/framebuffer", can you intercept its communications? Yes. When creating the namespace for the child, the parent can map names to what whatever communication channels it chooses. If the parent wants to interpose on the child's access to "/dev/class/framebuffer", the parent could map that name to a channel that leads back to the parent. > Can a process create a custom sandbox and run, say, AppMgr with limited permission to limit the permissions of all apps it manages? Yes. That's useful for testing as well as for sandboxing.
- stefankomatsu 9y agoAppreciate your your answers. This makes Fuchsia quite interesting to me.
- btrask 9y agoThank you for taking the time to reply, despite the sea of low quality comments on this HN thread.