From owner-freebsd-current@FreeBSD.ORG Fri May 21 02:04:07 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2A21B16A4CF; Fri, 21 May 2004 02:04:07 -0700 (PDT) Received: from tigra.ip.net.ua (tigra.ip.net.ua [82.193.96.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 22C0843D41; Fri, 21 May 2004 02:04:06 -0700 (PDT) (envelope-from ru@ip.net.ua) Received: from heffalump.ip.net.ua (heffalump.ip.net.ua [82.193.96.213]) by tigra.ip.net.ua (8.12.11/8.12.11) with ESMTP id i4L989vG027287 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 21 May 2004 12:08:11 +0300 (EEST) (envelope-from ru@ip.net.ua) Received: (from ru@localhost) by heffalump.ip.net.ua (8.12.11/8.12.11) id i4L92Ilc058152; Fri, 21 May 2004 12:02:18 +0300 (EEST) (envelope-from ru) Date: Fri, 21 May 2004 12:02:17 +0300 From: Ruslan Ermilov To: Gleb Smirnoff Message-ID: <20040521090217.GB57989@ip.net.ua> References: <20040520220145.GN4567@genius.tao.org.uk> <20040521080218.GY845@darkness.comp.waw.pl> <20040521081419.GB89262@cell.sick.ru> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="neYutvxvOLaeuPCA" Content-Disposition: inline In-Reply-To: <20040521081419.GB89262@cell.sick.ru> User-Agent: Mutt/1.5.6i X-Virus-Scanned: by amavisd-new X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) cc: Josef Karthauser cc: freebsd-current@freebsd.org cc: Pawel Jakub Dawidek Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 May 2004 09:04:07 -0000 --neYutvxvOLaeuPCA Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, May 21, 2004 at 12:14:19PM +0400, Gleb Smirnoff wrote: > On Fri, May 21, 2004 at 10:02:18AM +0200, Pawel Jakub Dawidek wrote: > P> Implementation wouldn't be probably too hard, but I can't agree it sho= uld > P> be committed. We need to know where jail's virtualization ends and I t= hink > P> it is too far. Of course it will be cool to have those sysctl on per-j= ail > P> basics, as well as others from security.bsd. tree > P> (like security.bsd.suser_enabled), but I'm not sure this is the right = way > P> to go. > P>=20 > P> Any other opinions? If someone convince me we should do it, I can do i= t. >=20 > A more general solution will be better, but harder to implement: make > some sysctl branches (e.g. security.bsd) local per jail, and possibility = to > change them only from host machine. >=20 I like the idea of per-jail sysctl MIB trees, e.g.: jail..security.bsd When jail gets created, the generic sysctl code would traverse the primary sysctl tree (excluding the jail. subtree), and copy and attach those that have some jail-related flag to the jail.. branch. Inside the jail, jail..security.bsd branch would map to just security.bsd. The generic sysctl code, when it detects it's run within a jail, will find a sysctl node "foo.bar", and if it has a jail-clone flag set, will remap a query to jail..foo.bar. Whether it's allowed to change a particular sysctl inside a jail is another matter. Cheers, --=20 Ruslan Ermilov ru@FreeBSD.org FreeBSD committer --neYutvxvOLaeuPCA Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFArcWZUkv4P6juNwoRAiVnAJ4/riJ6rCEKRADSB9ut77FinrCudwCfSCcx zYwd3kbNng1b/+cDXKF9fgU= =yPpl -----END PGP SIGNATURE----- --neYutvxvOLaeuPCA--