From owner-freebsd-net@FreeBSD.ORG Tue Feb 14 21:15:50 2006 Return-Path: X-Original-To: freebsd-net@FreeBSD.org Delivered-To: freebsd-net@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 69A0016A420 for ; Tue, 14 Feb 2006 21:15:50 +0000 (GMT) (envelope-from dougb@FreeBSD.org) Received: from mail2.fluidhosting.com (mx21.fluidhosting.com [204.14.89.4]) by mx1.FreeBSD.org (Postfix) with SMTP id BDF8943D55 for ; Tue, 14 Feb 2006 21:15:47 +0000 (GMT) (envelope-from dougb@FreeBSD.org) Received: (qmail 32712 invoked by uid 399); 14 Feb 2006 21:15:46 -0000 Received: from localhost (HELO ?192.168.0.3?) (dougb@dougbarton.us@127.0.0.1) by localhost with SMTP; 14 Feb 2006 21:15:46 -0000 Message-ID: <43F24880.3040208@FreeBSD.org> Date: Tue, 14 Feb 2006 13:15:44 -0800 From: Doug Barton Organization: http://www.FreeBSD.org/ User-Agent: Thunderbird 1.5 (X11/20060112) MIME-Version: 1.0 To: Harti Brandt References: <20060206092443.GA61116@totem.fix.no> <20060207141131.GU877@FreeBSD.org> <20060213173008.GA14643@totem.fix.no> <20060214090531.X5083@beagle.kn.op.dlr.de> <20060214083010.GB41864@totem.fix.no> <20060214093513.F5083@beagle.kn.op.dlr.de> <20060214084459.GL86448@cell.sick.ru> <20060214103723.GA45138@totem.fix.no> <20060214103901.GB68308@cell.sick.ru> <20060214105821.GA47035@totem.fix.no> <20060214154833.I5083@beagle.kn.op.dlr.de> In-Reply-To: <20060214154833.I5083@beagle.kn.op.dlr.de> X-Enigmail-Version: 0.94.0.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: freebsd-net@FreeBSD.org, Anders Nordby , Gleb Smirnoff , kuriyama@FreeBSD.org, demon@FreeBSD.org Subject: Re: bsnmpd X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Feb 2006 21:15:50 -0000 Harti Brandt wrote: > On Tue, 14 Feb 2006, Anders Nordby wrote: > AN>- Ability to chroot itself (yes please, for security). > > I don't have enough rc-foo for this. Perhaps someone can jump in here? This actually isn't all that hard. Basically you set $name_chroot to the directory it should chroot too. It's also a good idea to include that directory in required_dirs. If the bsnmpd binary has it's own chroot command line option, take a look at how rc.d/named does it in HEAD. Otherwise, there are notes in /etc/rc.subr and, the freebsd-rc@ list stands ready to help. :) Doug -- This .signature sanitized for your protection