Plash is a replacement Unix shell which lets the user run Linux programs with access only to the files and directories that they need to run.
Plash project works by virtualizing the filesystem. Each process can have its own file namespace.
This implemented in two steps: Firstly, processes are run in a chroot() environment under different UIDs, so they can't access files using the normal Linux system calls and are isolated from each other. Secondly, in order to open files, a process makes requests to a server process via a socket; the server can send file descriptors across the socket in reply.
Plash dynamically links programs with a modified version of GNU libc so that they can do filesystem operations using this different mechanism.
No kernel modifications are required. Plash can run Linux binaries unmodified, provided they are dynamically linked with libc, which is almost always the case.
In most cases this does not affect performance because the most frequently called system calls, such as read() and write(), are not affected.
What's New in This Release:
· The build system for PlashGlibc has been changed to integrate better with glibc's normal build process.
· As a result, it is easier to build Plash on architectures other than i386, and this is the first release to support AMD-64.
· The forwarding of stdin/stdout/stderr that was introduced in the previous release caused a number of bugs that should now be fixed.