From owner-freebsd-current@FreeBSD.ORG Fri May 21 07:52:20 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 178D116A4CE for ; Fri, 21 May 2004 07:52:20 -0700 (PDT) Received: from relay.rinet.ru (relay.rinet.ru [195.54.192.35]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4551643D2D for ; Fri, 21 May 2004 07:52:19 -0700 (PDT) (envelope-from flist@qqmore.rinet.ru) Received: from relay.rinet.ru (localhost [127.0.0.1]) by relay.rinet.ru (8.12.9p2/8.12.9) with ESMTP id i4LEq6YL067561 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 May 2004 18:52:06 +0400 (MSD) (envelope-from flist@qqmore.rinet.ru) Received: (from uucp@localhost) by relay.rinet.ru (8.12.9p2/8.12.9/Submit) with UUCP id i4LEq6eE067560 for freebsd-current@freebsd.org; Fri, 21 May 2004 18:52:06 +0400 (MSD) (envelope-from flist@qqmore.rinet.ru) Received: from qqmore.rinet.ru. (localhost.rinet.ru [127.0.0.1]) by qqmore.rinet.ru. (8.12.11/8.12.11) with ESMTP id i4LEqA0m003708 for ; Fri, 21 May 2004 18:52:10 +0400 (MSD) (envelope-from flist@qqmore.rinet.ru) Received: (from flist@localhost) by qqmore.rinet.ru. (8.12.11/8.12.11/Submit) id i4LEqALw003707 for freebsd-current@freebsd.org; Fri, 21 May 2004 18:52:10 +0400 (MSD) (envelope-from flist) Resent-From: flist@jabberwock.rinet.ru Resent-Date: Fri, 21 May 2004 18:52:09 +0400 Resent-Message-ID: <20040521145209.GC1403@qqmore.rinet.ru> Resent-To: freebsd-current@freebsd.org Date: Fri, 21 May 2004 18:12:39 +0400 From: Alex Semenyaka To: "Bjoern A. Zeeb" Message-ID: <20040521141239.GB1403@qqmore.rinet.ru> Mail-Followup-To: Alex Semenyaka , "Bjoern A. Zeeb" , Ruslan Ermilov , freebsd-current@freebsd.org References: <20040520220145.GN4567@genius.tao.org.uk> <20040521081419.GB89262@cell.sick.ru> <20040521090217.GB57989@ip.net.ua> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.6i cc: freebsd-current@freebsd.org Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 May 2004 14:52:20 -0000 On Fri, May 21, 2004 at 01:24:56PM +0000, Bjoern A. Zeeb wrote: > >> A more general solution will be better, but harder to implement: make > >> some sysctl branches (e.g. security.bsd) local per jail, and possibility to > >> change them only from host machine. >> I like the idea of per-jail sysctl MIB trees, e.g.: >> jail..security.bsd > jail ID is not too good; we would need s.th. that could be treated > 'perstistent' between reboots. Well, we can invent the jail naming like jail -N foo ... jail -N bar ... Then the first jail will have name ``foo'' and second one will be ``bar'' and the names will not depend on JIDs. Also we can require that name should start with letter, not digit so we always will know if we are dealing with a JID or with a name. And if jail has the name the corresponding sysctl subtree will be ``jail.'', otherwise ``jail.''. Names are persistent between reboots so a problem disappears. Looks like it is easy to implement as well. Could it be a right way to go? Sicerely, Alex Semenyaka