also known as user namespaces to the rescue again (available via lxc or other users of relevant parameterized syscalls), they've been available for a while... t

also known as user namespaces to the rescue again (available via lxc or other users of relevant parameterized syscalls), they've been available for a while... though libcontainer doesnt support. in conjunction with a good lsm, seccomp filtering, and capabilities thats pretty good protection. for those willing to endure the pain might also go with grsec.