From owner-freebsd-doc Thu Jun 6 1:42:36 2002 Delivered-To: freebsd-doc@freebsd.org Received: from oasis.uptsoft.com (oasis.uptsoft.com [217.20.165.41]) by hub.freebsd.org (Postfix) with ESMTP id 44BBC37B400 for ; Thu, 6 Jun 2002 01:42:22 -0700 (PDT) Received: (from devnull@localhost) by oasis.uptsoft.com (8.11.6/linuxconf) id g568gIg02201 for freebsd-doc@freebsd.org; Thu, 6 Jun 2002 11:42:18 +0300 Date: Thu, 6 Jun 2002 11:42:18 +0300 From: Sergey Lyubka To: freebsd-doc@freebsd.org Subject: developers-handbook/jail fix Message-ID: <20020606114218.A2194@oasis.uptsoft.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="3MwIy2ne0vdjdPXF" Content-Disposition: inline User-Agent: Mutt/1.2.5.1i Sender: owner-freebsd-doc@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hello, I think it makes sense. thanks, -sergey --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="developer-handbook.jail.diff" --- chapter.sgml.orig Wed Jun 5 15:32:23 2002 +++ chapter.sgml Wed Jun 5 15:32:06 2002 @@ -302,8 +302,11 @@ structures, &man.fork.2; checks if the structure p->p_prison is filled on p2. If it is, it increments the - pr.ref by one, and sets the - p_flag to one on the child process. + pr.ref by one, and sets P_JAILED flag in + p_flag node. The prison structure, + pr, is referenced by all the processes in a same + jail, so reference counter should be incremented after every new + process has been forked, and decremented after process' exit. /usr/src/sys/kern/kern_fork.c: if (p2->p_prison) { @@ -330,8 +333,10 @@ SysV IPC System V IPC is based on messages. Processes can send each - other these messages which tell them how to act. The functions - which deal with messages are: msgsys, + other these messages which tell them how to act. Actually, the + messages are sent and received from a special memory area, + called message queue. Message queue resides in kernel address space. + The functions which deal with messages are: msgsys, msgctl, msgget, msgsend and msgrcv. Earlier, I mentioned that there were certain sysctls you could @@ -340,23 +345,31 @@ most systems, this sysctl is set to 0. If it were set to 1, it would defeat the whole purpose of having a jail; privleged users from within the jail would be able to affect processes - outside of the environment. The difference between a message - and a signal is that the message only consists of the signal + outside of the environment. + + /usr/src/sys/kern/sysv_msg.c: &man.msgget.3;: msgget returns (and possibly - creates) a message descriptor that designates a message queue + creates) a message queue descriptor that designates a message queue for use in other system calls. &man.msgctl.3;: Using this function, a process - can query the status of a message - descriptor. + can query the status of a message queue. &man.msgsnd.3;: msgsnd sends a message to a - process. + message queue. &man.msgrcv.3;: a process receives messages using this function @@ -489,7 +502,8 @@ network layer 2. There are certain precautions which are taken in order to prevent a jailed process from binding a protocol to a certain port only if the nam - parameter is set. nam is a pointer to a sockaddr structure, + parameter is set when calling pcbind function. + nam is a pointer to a sockaddr structure, which describes the address on which to bind the service. A more exact definition is that sockaddr "may be used as a template for reffering to the identifying tag and length of --3MwIy2ne0vdjdPXF-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-doc" in the body of the message