Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 5 Aug 2003 06:51:12 -0500
From:      "Jacques A. Vidrine" <nectar@FreeBSD.org>
To:        Terry Lambert <tlambert2@mindspring.com>
Cc:        current@freebsd.org
Subject:   Re: Any patch for ICMP in a jail?
Message-ID:  <20030805115112.GA13555@madman.celabo.org>
In-Reply-To: <3F2F8D3B.7542C2A1@mindspring.com>
References:  <Pine.NEB.3.96L.1030804083230.49165B-100000@fledge.watson.org> <a0600120fbb5404c90190@[10.0.1.2]> <3F2E9D7F.AFEFF672@mindspring.com> <20030804212340.GD10339@madman.celabo.org> <3F2F8D3B.7542C2A1@mindspring.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 05, 2003 at 03:55:55AM -0700, Terry Lambert wrote:
> Through the credential passing?  I thought that wasn't reliable
> for this type of thing.  Specifically, the jail would be in an
> untrusted protection domain; if you just accepted the credential
> blindly, then anyone could be root in the jail, and you could not
> trust it.
> 
> If you didn't accept it blindly, then regular root loses existing
> functionality.
> 
> I'm pretty sure that, at least the last time I looke at it, the
> credential passing code didn't pass information about jail status.
[deletia]

Sorry, you are right.  Despite the subject line, I wasn't thinking of
jails at this point, but just of removing the setuid bit from ping.

Cheers,
-- 
Jacques Vidrine   . NTT/Verio SME      . FreeBSD UNIX       . Heimdal
nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030805115112.GA13555>