From owner-freebsd-current@FreeBSD.ORG  Mon Aug  4 10:54:31 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 6363137B401; Mon,  4 Aug 2003 10:54:31 -0700 (PDT)
Received: from stork.mail.pas.earthlink.net (stork.mail.pas.earthlink.net
	[207.217.120.188])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id BC40A43FA3; Mon,  4 Aug 2003 10:54:30 -0700 (PDT)
	(envelope-from tlambert2@mindspring.com)
Received: from user-38ldtqv.dialup.mindspring.com ([209.86.247.95]
	helo=mindspring.com)
	by stork.mail.pas.earthlink.net with asmtp (SSLv3:RC4-MD5:128)
	(Exim 3.33 #1)	id 19jjXK-0001ts-00; Mon, 04 Aug 2003 10:54:23 -0700
Message-ID: <3F2E9D7F.AFEFF672@mindspring.com>
Date: Mon, 04 Aug 2003 10:53:03 -0700
From: Terry Lambert <tlambert2@mindspring.com>
X-Mailer: Mozilla 4.79 [en] (Win98; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Brad Knowles <brad.knowles@skynet.be>
References: <Pine.NEB.3.96L.1030804083230.49165B-100000@fledge.watson.org>
	<a0600120fbb5404c90190@[10.0.1.2]>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-ELNK-Trace: b1a02af9316fbb217a47c185c03b154d40683398e744b8a48e49cbb1778efbaac5b5cae838f4a492350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
cc: Robert Watson <rwatson@freebsd.org>
cc: current@freebsd.org
Subject: Re: Any patch for ICMP in a jail?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Aug 2003 17:54:31 -0000

Brad Knowles wrote:
> At 8:35 AM -0400 2003/08/04, Robert Watson wrote:
> >       The best short-term suggestion would be to write a
> >  privilege-separated ping tool -- a pingd running outside the jail,
> >  providing UNIX domain sockets in each jail that needs the ability to ping;
> >  ping then becomes a client that RPC's to pingd.
> 
>         It strikes me that this is probably a better solution to the
> problem regardless of whether or not you are in a jail.  By carefully
> controlling the RPC interface, you should be able to reduce the
> security exposure, simplify pingd, and bring more of the complex
> logic into the unprivileged ping client.
> 
>         This would also allow you to apply the same solution for jail vs.
> non-jail environments.
> 
>         Is this a future enhancement that we can realistically look forward to?

You would either lose or overexpose root-restricted functionality,
such as flood-ping.

-- Terry