From owner-freebsd-stable  Sat Oct  9 12: 7:55 1999
Delivered-To: freebsd-stable@freebsd.org
Received: from gw.nectar.com (gw.nectar.com [209.98.143.44])
	by hub.freebsd.org (Postfix) with ESMTP id D09CD14DF3
	for <freebsd-stable@FreeBSD.ORG>; Sat,  9 Oct 1999 12:07:53 -0700 (PDT)
	(envelope-from nectar@nectar.com)
Received: from bone.nectar.com (bone.nectar.com [10.0.0.105])
	by gw.nectar.com (Postfix) with ESMTP
	id AE4E9C006; Sat,  9 Oct 1999 14:07:52 -0500 (CDT)
Received: from bone.nectar.com (localhost [127.0.0.1])
	by bone.nectar.com (Postfix) with ESMTP
	id 14C771D87; Sat,  9 Oct 1999 14:07:52 -0500 (CDT)
X-Mailer: exmh version 2.0.2 2/24/98
X-Exmh-Isig-CompType: repl
X-Exmh-Isig-Folder: mlist/freebsd/stable
X-PGP-RSAfprint: 00 F9 E6 A2 C5 4D 0A 76  26 8B 8B 57 73 D0 DE EE
X-PGP-RSAkey: http://www.nectar.com/nectar-rsa.txt
X-PGP-DSSfprint: AB2F 8D71 A4F4 467D 352E  8A41 5D79 22E4 71A2 8C73
X-PGP-DHfprint: 2D50 12E5 AB38 60BA AF4B  0778 7242 4460 1C32 F6B1
X-PGP-DH-DSSkey: http://www.nectar.com/nectar-dh-dss.txt
From: Jacques Vidrine <n@nectar.com>
To: Matt Behrens <matt@zigg.com>
Cc: freebsd-stable@FreeBSD.ORG
In-reply-to: <Pine.BSF.4.10.9910091247260.25227-100000@megaweapon.zigg.com> 
References: <Pine.BSF.4.10.9910091247260.25227-100000@megaweapon.zigg.com>
Subject: Re: merging current's jail functionality to stable 
Mime-Version: 1.0
Content-Type: text/plain
Date: Sat, 09 Oct 1999 14:07:51 -0500
Message-Id: <19991009190752.14C771D87@bone.nectar.com>
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On 9 October 1999 at 12:48, Matt Behrens <matt@zigg.com> wrote:
> Is suser needed to properly support jail?  Without suser being
> updated, will we have a hole in the implementation?

No, see src/sys/kern_prot.c in -CURRENT for details.  Anything that
uses suser (rather than suser_xxx) does NOT grant superuser
priviledges to jail'd processes, even where those process have 
uid == 0.

The only way to grant jail'd process superuser priviledges is by calling
suser_xxx instead of suser, and passing an explicit flag.  That's done
in about 28 places in the source tree.

Jacques Vidrine / n@nectar.com / nectar@FreeBSD.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message