From owner-freebsd-jail@freebsd.org Sun Dec 13 17:50:18 2015 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 906D4A438D0 for ; Sun, 13 Dec 2015 17:50:18 +0000 (UTC) (envelope-from schultz@ime.usp.br) Received: from iris.ime.usp.br (iris.ime.usp.br [143.107.45.5]) by mx1.freebsd.org (Postfix) with ESMTP id 4E1AD15B3 for ; Sun, 13 Dec 2015 17:50:17 +0000 (UTC) (envelope-from schultz@ime.usp.br) Received: from hpmini (unknown [187.65.219.230]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: schultz@iris.ime.usp.br) by iris.ime.usp.br (Postfix) with ESMTPSA id 9E6042900D5F; Sun, 13 Dec 2015 15:50:13 -0200 (BRST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ime.usp.br; s=mail; t=1450029017; bh=lMwFx+a7CL2f/+Wjrx2RHESUmcixAIDLFYGuTt96Rp4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mwXnmJfycLDmbpbrn2KpKH9Fno1ZmNXC2BYY4Iqx3vpKLBkiidNBqflMmxd48nzIq uXA+sUy0LmVTVJK2IL+nkLYgQajxDxeO4yxTuecZvLmbSdYuCsWcOhYFzhKukLewva x4BmiuKULHPKOH+sZGMRmI+O8L5c05Y8Hvac0E3o= Date: Sun, 13 Dec 2015 15:52:01 -0200 From: =?utf-8?B?THXDrXM=?= Fernando Schultz Xavier da Silveira To: Konstantin Belousov Cc: James Gritton , freebsd-jail@freebsd.org Subject: Re: OSS in jail Message-ID: <20151213175201.GB871@hpmini> References: <20151212224422.GB4884@hpmini> <20151213160522.GY82577@kib.kiev.ua> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20151213160522.GY82577@kib.kiev.ua> User-Agent: Mutt/1.5.23 (2014-03-12) X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on iris.ime.usp.br X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Dec 2015 17:50:18 -0000 I see. I does indeed seem a sound server is the appropriate solution. Thanks. On Sun, Dec 13, 2015 at 06:05:22PM +0200, Konstantin Belousov wrote: > On Sun, Dec 13, 2015 at 08:23:57AM -0700, James Gritton wrote: > > On 2015-12-12 15:44, Lu??s Fernando Schultz Xavier da Silveira wrote: > > > > > > I would like one of my jails to have the ability to play back sound, > > > but not to record it. As I understand, sound is played back by writing > > > to /dev/dsp and recorded by reading from it. Hence, placing the > > > /dev/dsp > > > device (and /dev/dsp[0-9]* devices) in the jail via devfs.rules is not > > > a solution since the jail superuser can override permissions on these > > > devices and even read from them when they lack read permission. > > > > > > Is there a way to give a device to a jail in write-only mode? > > > If not, is it possible to create a virtual OSS stack and give that to > > > the jail? > > > How would you solve this problem? > > > > > > Also, is it possible to give the jail a mixer device that can only read > > > mixer settings but not alter them? > > > > There is no mechanism for adding a device to a jail with partial > > permissions. Generally, it wouldn't just be reading and writing, but a > > per-device decision on different ioctl calls. This would require an > > entire jail device framework that doesn't exist. > > > > I suppose it's possible to create a virtual OSS stack - sounds like a > > pretty big project though. If I had this job to do, that's likely the > > direction I'd go, though instead of a virtual OSS driver, I'd consider > > something on the user level, with a listening UNIX socket inside the > > jail. I doubt this would work seamlessly without recompiling software > > though (again, the ioctl question). > > There is a lot of usermode sound servers, already written, some of them > are even used. I am sure that among the dozens there are several which > would allow to restrict access and provide connector into the jail. > > IMO it is much more practical way to achieve the stated goal than try > to restrict /dev/dsp access. > _______________________________________________ > freebsd-jail@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-jail > To unsubscribe, send any mail to "freebsd-jail-unsubscribe@freebsd.org" >