Date: Tue, 22 Apr 2025 12:39:17 -0400 From: Garrett Wollman <wollman@csail.mit.edu> To: Gordon Tetlow <gordon@tetlows.org> Cc: freebsd-pkgbase@freebsd.org Subject: Re: Splitting critical libraries from interactive shell in runtime package Message-ID: <26631.50741.155084.424170@khavrinen.csail.mit.edu> In-Reply-To: <015C4C6B-1CEC-4398-A8B9-CE21E88C617C@tetlows.org>
index | next in thread | previous in thread | raw e-mail
<<On Mon, 21 Apr 2025 10:43:44 -0700, Gordon Tetlow <gordon@tetlows.org> said: > A while ago, I was playing around with building stripped down jails > based on pkgbase and noticed that /bin/sh and a whole host of > interactive commands is in the FreeBSD-runtime package. This seemed > weird to me as my stripped down jail that is intended to run nginx > should only have the runtime libraries necessary. Including /bin/sh > and friends is unnecessary and would only enable an attacker to gain > a foothold more easily. Part of the functionality of the standard C library is implemented in the shell. You probably don't need any of these functions, and maybe given your security posture you would prefer if they didn't work. POSIX generally requires a shell. I think pkgbase is perhaps not conceived for this application: a shell is not normally thought of as an optional component. -GAWollmanhelp
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?26631.50741.155084.424170>