Date: Mon, 4 Aug 2003 14:42:50 +0200 From: Brad Knowles <brad.knowles@skynet.be> To: Robert Watson <rwatson@freebsd.org> Cc: current@freebsd.org Subject: Re: Any patch for ICMP in a jail? Message-ID: <a0600120fbb5404c90190@[10.0.1.2]> In-Reply-To: <Pine.NEB.3.96L.1030804083230.49165B-100000@fledge.watson.org> References: <Pine.NEB.3.96L.1030804083230.49165B-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 8:35 AM -0400 2003/08/04, Robert Watson wrote:
> The best short-term suggestion would be to write a
> privilege-separated ping tool -- a pingd running outside the jail,
> providing UNIX domain sockets in each jail that needs the ability to ping;
> ping then becomes a client that RPC's to pingd.
It strikes me that this is probably a better solution to the
problem regardless of whether or not you are in a jail. By carefully
controlling the RPC interface, you should be able to reduce the
security exposure, simplify pingd, and bring more of the complex
logic into the unprivileged ping client.
This would also allow you to apply the same solution for jail vs.
non-jail environments.
Is this a future enhancement that we can realistically look forward to?
--
Brad Knowles, <brad.knowles@skynet.be>
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-Benjamin Franklin, Historical Review of Pennsylvania.
GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a0600120fbb5404c90190>