From owner-freebsd-security Mon Feb 24 08:02:51 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id IAA25622 for security-outgoing; Mon, 24 Feb 1997 08:02:51 -0800 (PST) Received: from bofh.cybercity.dk (bofh.cybercity.dk [195.8.128.254]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id IAA25592; Mon, 24 Feb 1997 08:02:42 -0800 (PST) Received: from critter.dk.tfs.com ([140.145.230.252]) by bofh.cybercity.dk (8.8.3/8.7.3) with ESMTP id RAA26167; Mon, 24 Feb 1997 17:04:49 +0100 (MET) Received: from critter.dk.tfs.com (localhost [127.0.0.1]) by critter.dk.tfs.com (8.8.2/8.8.2) with ESMTP id RAA04365; Mon, 24 Feb 1997 17:05:00 +0100 (MET) To: Julian Assange cc: hackers@freebsd.org, security@freebsd.org Subject: Re: o [1997/02/01] bin/2634 rtld patches for easy creation of chroot enviroments In-reply-to: Your message of "Tue, 25 Feb 1997 00:28:33 +1100." <199702241328.AAA10815@profane.iq.org> Date: Mon, 24 Feb 1997 17:05:00 +0100 Message-ID: <4363.856800300@critter.dk.tfs.com> From: Poul-Henning Kamp Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk In message <199702241328.AAA10815@profane.iq.org>, Julian Assange writes: >plannet are you on? Earth, 3rd from the center. (Mostly harmless). >The primary reason chroot() is rarely used is because it is painful >to use. No, it's because it doesn't really offer isolation when you have networking and other non-filesystem controlled interfaces to the kernel. Once you have implemented true "virtual machine" semantics for chroot, including local /sbin/init process &c &c it will be useful. >I'm quite apalled at this conservative view, >expressed without the slightest understanding of the code involved. I have a far better understanding of the code than you have. Julian, you need to calm down and work on something different. Your proposed feature isn't the magical bullet it takes to make chroot a safe place to live. If it were I would embrace it. As it is, adding this gruesome hack doesn't really provide us with anything that improves the situation. If you think otherwise, do it on your own systems. Poul-Henning -- Poul-Henning Kamp | phk@FreeBSD.ORG FreeBSD Core-team. http://www.freebsd.org/~phk | phk@login.dknet.dk Private mailbox. whois: [PHK] | phk@tfs.com TRW Financial Systems, Inc. Power and ignorance is a disgusting cocktail.