From owner-freebsd-questions@freebsd.org Sun Dec 6 20:19:32 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 647F07BE8 for ; Sun, 6 Dec 2015 20:19:32 +0000 (UTC) (envelope-from milios@ccsys.com) Received: from cargobay.net (cargobay.net [198.178.123.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4819E19A2 for ; Sun, 6 Dec 2015 20:19:31 +0000 (UTC) (envelope-from milios@ccsys.com) Received: from [192.168.0.4] (97-97-253-103.res.bhn.net [97.97.253.103]) by cargobay.net (Postfix) with ESMTPSA id 3127B622; Sun, 6 Dec 2015 20:07:16 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) Subject: Re: OSS in jail From: Jake X-Mailer: iPhone Mail (13B143) In-Reply-To: Date: Sun, 6 Dec 2015 15:09:44 -0500 Cc: =?utf-8?Q?Lu=C3=ADs_Fernando_Schultz_Xavier_da_Silveira?= , freebsd-questions@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <4A96B34F-EC69-4036-8D49-73C9B1E662F1@ccsys.com> References: <20151206194401.GA3860@hpmini> <20151206194958.GB4044@hpmini> To: Anton Sayetsky X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Dec 2015 20:19:32 -0000 > On Dec 6, 2015, at 2:51 PM, Anton Sayetsky wrote: >=20 > 2015-12-06 21:49 GMT+02:00 Lu=C3=ADs Fernando Schultz Xavier da Silveira > : >> Sorry, I meant write-only mode. > If a user has write access, how do you want to prevent him to set permissi= ons? I think that's what he's asking us, the general community. Maybe not for a s= olution as simple as the standard device nodes and permissions, since he als= o described his use case as the actual goal. Without actually forming a spec= ific plan for u in detail, a setup involving network send/receive and on a s= olution such as what Jack2 (and others) provide comes to mind. That may work= for you Fernando or it may not be low-level enough to fit all your desires.= Perhaps a simpler solution using the append-only file flag would suffice an= d disallowing the jail to change flags is workable. See allow.chflags in man= 8 jail and/or man 5 jail.conf. I believe there's a global setting and a per= jail setting. I'm interested in hearing about what solutions you/we can come up with.=