Date: Fri, 21 May 2004 18:12:39 +0400 From: Alex Semenyaka <flist@jabberwock.rinet.ru> To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> Cc: freebsd-current@freebsd.org Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only Message-ID: <20040521141239.GB1403@qqmore.rinet.ru> In-Reply-To: <Pine.BSF.4.53.0405211323440.58123@e0-0.zab2.int.zabbadoz.net> References: <20040520220145.GN4567@genius.tao.org.uk> <20040521081419.GB89262@cell.sick.ru> <20040521090217.GB57989@ip.net.ua> <Pine.BSF.4.53.0405211323440.58123@e0-0.zab2.int.zabbadoz.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, May 21, 2004 at 01:24:56PM +0000, Bjoern A. Zeeb wrote: > >> A more general solution will be better, but harder to implement: make > >> some sysctl branches (e.g. security.bsd) local per jail, and possibility to > >> change them only from host machine. >> I like the idea of per-jail sysctl MIB trees, e.g.: >> jail.<JID>.security.bsd > jail ID is not too good; we would need s.th. that could be treated > 'perstistent' between reboots. Well, we can invent the jail naming like jail -N foo ... jail -N bar ... Then the first jail will have name ``foo'' and second one will be ``bar'' and the names will not depend on JIDs. Also we can require that name should start with letter, not digit so we always will know if we are dealing with a JID or with a name. And if jail has the name the corresponding sysctl subtree will be ``jail.<NAME>'', otherwise ``jail.<JID>''. Names are persistent between reboots so a problem disappears. Looks like it is easy to implement as well. Could it be a right way to go? Sicerely, Alex Semenyaka
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040521141239.GB1403>