From owner-freebsd-security@FreeBSD.ORG Tue Apr 20 02:20:48 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D42C416A4D0; Tue, 20 Apr 2004 02:20:48 -0700 (PDT) Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.86.163]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0EE3343D2D; Tue, 20 Apr 2004 02:20:48 -0700 (PDT) (envelope-from phk@phk.freebsd.dk) Received: from critter.freebsd.dk (localhost [127.0.0.1]) by critter.freebsd.dk (8.12.11/8.12.11) with ESMTP id i3K9KbE5014523; Tue, 20 Apr 2004 11:20:43 +0200 (CEST) (envelope-from phk@phk.freebsd.dk) To: "Christian S.J. Peron" From: "Poul-Henning Kamp" In-Reply-To: Your message of "Tue, 20 Apr 2004 01:56:38 -0000." <20040420015638.A84821@staff.seccuris.com> Date: Tue, 20 Apr 2004 11:20:37 +0200 Message-ID: <14522.1082452837@critter.freebsd.dk> cc: freebsd-hackers@freebsd.org cc: freebsd-security@freebsd.org Subject: Re: [patch] Raw sockets in jails X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Apr 2004 09:20:49 -0000 In message <20040420015638.A84821@staff.seccuris.com>, "Christian S.J. Peron" w rites: > > Although RAW sockets can be used when specifying the source > address of packets (defeating one of the aspects of the jail) > some people may find it usefull to use utilities like ping(8) > or traceroute(8) from inside jails. > > Enclosed is a patch I have written which gives you the option > of allowing prison-root to create raw sockets inside the prison, > so that programs various network debugging programs like ping > and traceroute etc can be used. > > This patch will create the security.jail.allow_raw_sockets sysctl > MIB. I would appriciate any feed-back from testers > > See PR #: > http://www.freebsd.org/cgi/query-pr.cgi?pr=65800 Could you take a peek and see how hard it would be to enforce source-IP compliance with the jail restriction ? -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.