Date: Fri, 21 May 2004 11:41:19 +0200 From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: Ruslan Ermilov <ru@freebsd.org> Cc: freebsd-current@freebsd.org Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only Message-ID: <20040521094119.GB845@darkness.comp.waw.pl> In-Reply-To: <20040521090217.GB57989@ip.net.ua> References: <20040520220145.GN4567@genius.tao.org.uk> <20040521080218.GY845@darkness.comp.waw.pl> <20040521081419.GB89262@cell.sick.ru> <20040521090217.GB57989@ip.net.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
--V0UVtYtGm5R6mXNF Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, May 21, 2004 at 12:02:17PM +0300, Ruslan Ermilov wrote: +> I like the idea of per-jail sysctl MIB trees, e.g.: +>=20 +> jail.<JID>.security.bsd +>=20 +> When jail gets created, the generic sysctl code would traverse +> the primary sysctl tree (excluding the jail. subtree), and copy +> and attach those that have some jail-related flag to the +> jail.<JID>. branch. +>=20 +> Inside the jail, jail.<JID>.security.bsd branch would map to +> just security.bsd. +>=20 +> The generic sysctl code, when it detects it's run within a +> jail, will find a sysctl node "foo.bar", and if it has a +> jail-clone flag set, will remap a query to jail.<JID>.foo.bar. +>=20 +> Whether it's allowed to change a particular sysctl inside +> a jail is another matter. There are two main issues with our current sysctls implementation: 1. We cannot hide sysctls/sysctl-trees. 2. We're operating in most cases on integers. We can work on 1, but we can't hack 2 easly, we have to transform sysctls, that have to be treated on per-jail basics from SYSCTL_INT to SYSCTL_PROC and if so, I'm not sure what for do we need security.jail.<JID> trees then. We can implement them in the same way security.jail.jailed is impelemented (it shows different value outside a jail and different inside) and if we want to change it: # jexec <JID> /sbin/sysctl <some_sysctl>=3D<some_value> Of course, there could be no /sbin/sysctl utility inside a jail, but I'll still suggest to add '-j' option to sysctl command to work just like 'killall -j' (i.e. jail_attach(<JID>); sysctl();). --=20 Pawel Jakub Dawidek http://www.FreeBSD.org pjd@FreeBSD.org http://garage.freebsd.pl FreeBSD committer Am I Evil? Yes, I Am! --V0UVtYtGm5R6mXNF Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFArc6/ForvXbEpPzQRAtt2AKCNwz2sEkd7hhSFDEisVk197oQE0ACZARb5 P9t57jlnz3s1+O5v1tg/20M= =A/+t -----END PGP SIGNATURE----- --V0UVtYtGm5R6mXNF--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040521094119.GB845>