ZFS is there. Great! Thanks Pawel!
Now I wait a little bit until the first bugs are ironed out, and then I move all my stuff to it. The nice part: when you have 2 machines and everything you use is jailed, you just can do this without an “interruption of service” (or at least only with a very small one). Just move the jails to the other machine, replace the old FS with ZFS, and then move all jails back.
Yeah! Finally I got time to finish my work to put a desktop environment (in this case GNOME) into a jail. At least I have a proof of concept (I write this with firefox running in my “deskjail”). No, I don’t do this for additional security (there’s more security than in a non-jailed setup, but less security than in an ordinary jail, as you have to allow access to a lot more devices than in an ordinary jail), I do this for additional flexibility: Moving my desktop is now only the install of FreeBSD on a new machine and rsyncing the jail over to it. As the machine will also be a host of several jails where I have some common users with the same UID in each jail, I don’t pollute the jail-host with the desktop stuff and I have everything nicely separated.
Without a kernel patch and good devfs rules you will not get Xorg up and running in a jail (at least I didn’t managed to let it recognize my graphic card without the kernel patch). Now I have to beef up the patch a little bit and ask for review (it weakens up the security a little bit like the sysctl security.jail.sysvipc_allowed=1 or security.jail.allow_raw_sockets=1).
But first I have to finish the move of all my services I use at home to the jail-host now.
We got a lot of good proposals. Google is willing to give us a very nice amount of students. We didn’t expected this much. Thanks!
Now we need to rate the student applications and find suitable mentors… not that easy. It’s easy for the strongest proposals, but for the rest I expect that there will be some shuffling around until the very end.
The linuxulator is synced on amd64 with i386 (since a while). This means TLS is working now and we have the same (a little bit buggy) futexes.
Roman is slowly working on the *at() commands. He also applied for the GSoC this year again. Kib is willing to mentor (in case Roman gets a free seat in the SoC). I rejected the mentoring position this time, as I don’t know if I will have enough time this summer, but I hope I will be around.