Re: chrooting daemons

[Topi Miettinen <Topi.Miettinen@ml.tele.fi>]

Bruce Perens writes:
> From: dark@xs4all.nl (Richard Braakman)
> > It might be even easier to link the daemon statically.
> 
> No, the small security or filesystem integrity gain of using a static-linked
> binary is not worth the cost of having a second copy of libraries in its
> working set. The developers have discussed this several times.

But if the libraries are not hard linked (that probably would be ruined in
update), I believe they would still be in memory more than once, because
they then had different inodes and the OS would have no way of knowing they
are the same.

I agree that it's better to have the daemons do the chrooting. Without
dynamic linker and libraries in the chrooted location, it would be harder
for runaway code to create new programs.

-Topi