![](/images/new-backgrounds/1330589/330589115x1.webp)
Figure 5-1 Compartment Architecture
process
process relationship files and/or directories file access
network
IPC signals
recorder
All
/
/var/opt/server
| read | |||
| read, | write | ||
|
| write | ||
logs | read, | |||
| ||||
|
|
|
spool
Compartment
server_parent server_children lan cmpt 1
parent
handler handler
handler
Network
In Figure
•All the handler processes is configured to communicate with the network.
•The recorder can access the file system.
•The handlers have read, and read/write access to parts of the file system.
•The handler processes can communicate with the parent process, and with the recorder via IPC and signals.
•The network is isolated from the recorder and the parent process.
This compartment configuration provides security for the file system and the recorder. Both are isolated by their compartments. Though the handler processes can communicate with the network, the network cannot be accessed by the recorder or the parent process.
58 Compartments