Date: Sun, 8 May 2011 14:57:01 +0000 (UTC) From: Benedict Reuschling <bcr@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r221665 - head/usr.sbin/jail Message-ID: <201105081457.p48Ev1OA051185@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bcr (doc committer) Date: Sun May 8 14:57:01 2011 New Revision: 221665 URL: http://svn.freebsd.org/changeset/base/221665 Log: Revert r221655: Various people voiced their concerns about these changes. Until this is resolved, we should use the old version. Modified: head/usr.sbin/jail/jail.8 Modified: head/usr.sbin/jail/jail.8 ============================================================================== --- head/usr.sbin/jail/jail.8 Sun May 8 14:56:02 2011 (r221664) +++ head/usr.sbin/jail/jail.8 Sun May 8 14:57:01 2011 (r221665) @@ -34,7 +34,7 @@ .\" .\" $FreeBSD$ .\" -.Dd May 8, 2011 +.Dd January 17, 2010 .Dt JAIL 8 .Os .Sh NAME @@ -431,7 +431,7 @@ command script can be used: .Bd -literal D=/here/is/the/jail cd /usr/src -mkdir -p -m 0700 $D +mkdir -p $D make world DESTDIR=$D make distribution DESTDIR=$D mount -t devfs devfs $D/dev @@ -448,10 +448,6 @@ in the per-jail devfs. A simple devfs ruleset for jails is available as ruleset #4 in .Pa /etc/defaults/devfs.rules . .Pp -Non-superusers in the host system should not be able to access the -jail's files; otherwise an attacker with root access to the jail -could obtain elevated privileges on the host. -.Pp In many cases this example would put far more in the jail than needed. In the other extreme case a jail might contain only one file: the executable to be run in the jail.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201105081457.p48Ev1OA051185>