Skip to content
academia.sh
tr
Log in

Course Advanced

Kernel Interfaces and Isolation

By the end of this course

Start course

01

Isolation Mechanisms

Process, mount, network, user, and machine namespaces, cgroups, privileges, mandatory access control, and how they come together in a container runtime.

  1. 01 Namespaces A process's 24 observable facts spread across nine axes; five namespaces close nine of them, leave 15 open, and can fully close only two of the nine axes.
  2. 02 Control Groups The cgroup closes three of the resource axis's four facts and leaves the CPU count open; in the six-mechanism bundle the visible fact count drops from 15 to 12, and the open axis count still stands at 7.
  3. 03 Capabilities Superuser privilege is divided into separately grantable pieces; capability dropping closes only one of two facts and file permissions stay open, and in the seven-mechanism bundle the visible fact count drops to 11.
  4. 04 Mandatory Access Control Policy-based control closes one of the label axis's two facts and leaves the access label open; of 36 access pairs, 8 are required, while a coarse policy leaves 10 excess permissions and a narrow policy leaves 1.
  5. 05 Container Runtime The common six-mechanism bundle leaves 12 facts, the strict eight-mechanism bundle leaves 10: adding two mechanisms narrows the surface by only 2 facts, and the open axis count stands at 7 after the fourth mechanism.

02

Observation and Debugging

System call tracing, sampling-based profiling, in-kernel tracing, and core dump analysis; the fact each channel brings back and the cost it charges.

  1. 01 System Call Tracing The first measure of observation piercing isolation: of the 14 facts the strict bundle closes, 2 return through system call tracing, the open surface climbs from 10 to 12, and the run slows by 34 percent; three of the five facts the channel shows were already visible.
  2. 02 Performance Profiling The cheapest and narrowest of the four channels: the sampling-based CPU profile brings back only 1 of the 14 facts the strict bundle closes, the open surface becomes 11, and the run slows by 3 percent; the returned fact does not change when the sample count grows a thousandfold.
  3. 03 In-Kernel Tracing Measuring event-based in-kernel tracing: 3 facts return for a 6-percent cost, the open surface becomes 13, and the axis the network namespace closes fully reopens, taking open axes from 7 to 8; at 2.00 points per fact, it is the lowest of the four channels.
  4. 04 Core Dump Analysis Measuring the channel whose run cost is zero: a core dump brings back 3 of the 14 facts the strict bundle closes, the open surface becomes 13, and all four channels together bring back 8 facts, taking the return ratio to 0.5714; the dump's cost sits not in the run but in the sensitive data it carries.

Start typing to search.

↑↓ ↵ Esc navigate · open · close