Date: Fri, 21 May 2004 10:02:18 +0200 From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: Josef Karthauser <joe@FreeBSD.org> Cc: freebsd-current@freebsd.org Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only Message-ID: <20040521080218.GY845@darkness.comp.waw.pl> In-Reply-To: <20040520220145.GN4567@genius.tao.org.uk> References: <20040520220145.GN4567@genius.tao.org.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
--MaQSLyDmO9KOouzV Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, May 20, 2004 at 11:01:45PM +0100, Josef Karthauser wrote: +> I was wondering whether someone might help me out. +>=20 +> There's a couple of sysctls in -current: +>=20 +> security.bsd.see_other_uids: 1 +> security.bsd.see_other_gids: 1 +>=20 +> These effectively allow one to prevent users from spying on each +> other. +>=20 +> What I need to do is to disable these within jails, but not in the +> host enviroment. The reason I need this is that I'm running the +> FreeBSD election on a box of mine, but I don't want to have to clear +> these globally. +>=20 +> Would someone have the time to hack me a patch to do this? It doesn't +> have to be clean, although evenually I'd like to see something like +> this committed to freebsd operating on a sysctl. Implementation wouldn't be probably too hard, but I can't agree it should be committed. We need to know where jail's virtualization ends and I think it is too far. Of course it will be cool to have those sysctl on per-jail basics, as well as others from security.bsd. tree (like security.bsd.suser_enabled), but I'm not sure this is the right way to go. Any other opinions? If someone convince me we should do it, I can do it. --=20 Pawel Jakub Dawidek http://www.FreeBSD.org pjd@FreeBSD.org http://garage.freebsd.pl FreeBSD committer Am I Evil? Yes, I Am! --MaQSLyDmO9KOouzV Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFArbeKForvXbEpPzQRAm6rAKDlFMx67guTfiy19Fu+JzsoUJelpgCgg9tw LA+FUaoEJnnHkmA/uAVsCtc= =o+6Q -----END PGP SIGNATURE----- --MaQSLyDmO9KOouzV--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040521080218.GY845>