From owner-freebsd-bugs@FreeBSD.ORG Tue Aug 5 07:30:15 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 74E4937B401 for ; Tue, 5 Aug 2003 07:30:15 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1197043F93 for ; Tue, 5 Aug 2003 07:30:15 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h75EUEUp018904 for ; Tue, 5 Aug 2003 07:30:14 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h75EUEtm018903; Tue, 5 Aug 2003 07:30:14 -0700 (PDT) Date: Tue, 5 Aug 2003 07:30:14 -0700 (PDT) Message-Id: <200308051430.h75EUEtm018903@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Dmitry Morozovsky Subject: Re: kern/55163: [patch] hide kld system details from jails X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Dmitry Morozovsky List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Aug 2003 14:30:15 -0000 The following reply was made to PR kern/55163; it has been noted by GNATS. From: Dmitry Morozovsky To: Yar Tikhiy Cc: FreeBSD-gnats-submit@FreeBSD.org Subject: Re: kern/55163: [patch] hide kld system details from jails Date: Tue, 5 Aug 2003 18:22:53 +0400 (MSD) On Tue, 5 Aug 2003, Yar Tikhiy wrote: YT> > Well, security thru obscurity is not the best technique ;-) YT> > However, it seems that reveal too much info about host system for jail user, YT> > or even for jail admin, is not always the best. We plan to use it together with YT> > Pawel Jakub Dawidek's jailfsstat kernel module. YT> > YT> > This code path is rare, so no performance problem I think. Any objections? YT> YT> The only objection I can see is that a generalized framework for YT> restricting system interfaces within a jail should be developed YT> instead of sticking in "if (foo_allowed)" everywhere. In general I do agree; however, as far as I can see, in 5.x this functionality *is* being developed in general way via MAC, which has no chances to be back-ported; secondly, due to limited lifetime frame of 4.x branch, the process of general development would not be successful => I suppose band-aid with if(xxx_allowed) would be appropriate to achieve desired functionality. Well, as there are objections, I suppose the discussion should be moved to -stable@ ? Sincerely, D.Marck [DM5020, MCK-RIPE, DM3-RIPN] ------------------------------------------------------------------------ *** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck@rinet.ru *** ------------------------------------------------------------------------