From owner-freebsd-arch@FreeBSD.ORG  Thu Jul 17 01:46:24 2003
Return-Path: <owner-freebsd-arch@FreeBSD.ORG>
Delivered-To: freebsd-arch@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1345B37B401
	for <freebsd-arch@freebsd.org>; Thu, 17 Jul 2003 01:46:24 -0700 (PDT)
Received: from shrike.submonkey.net (pc1-cdif2-5-cust38.cdif.cable.ntl.com
	[81.101.150.38])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 58CD743F75
	for <freebsd-arch@freebsd.org>; Thu, 17 Jul 2003 01:46:21 -0700 (PDT)
	(envelope-from setantae@submonkey.net)
Received: from setantae by shrike.submonkey.net with local (Exim 4.20)
	id 19d4P5-000FYg-U9
	for freebsd-arch@freebsd.org; Thu, 17 Jul 2003 09:46:19 +0100
Date: Thu, 17 Jul 2003 09:46:19 +0100
From: Ceri Davies <setantae@submonkey.net>
To: freebsd-arch@freebsd.org
Message-ID: <20030717084619.GS403@submonkey.net>
References: <20030717080805.GA98878@dragon.nuxi.com>
	<20030717084333.GB35337@funkthat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030717084333.GB35337@funkthat.com>
User-Agent: Mutt/1.5.4i
Sender: Ceri Davies <setantae@submonkey.net>
Subject: Re: Things to remove from /rescue
X-BeenThere: freebsd-arch@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussion related to FreeBSD architecture
	<freebsd-arch.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-arch>,
	<mailto:freebsd-arch-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-arch>
List-Post: <mailto:freebsd-arch@freebsd.org>
List-Help: <mailto:freebsd-arch-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-arch>,
	<mailto:freebsd-arch-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Jul 2003 08:46:24 -0000

On Thu, Jul 17, 2003 at 01:43:33AM -0700, John-Mark Gurney wrote:
> David O'Brien wrote this message on Thu, Jul 17, 2003 at 01:08 -0700:
> > - ipfw & natd & ipf & ipfs & ipfstat & ipmon & ipnan, why would one needs
> >   these?  /rescue is to fix a borked /, not replace PicoBSD.
> 
> ipfw I can see as useful.  If you have a kernel that defaults to closed,
> and you need to access the network, then this is a problem.  If we had
> a loader tunable to make a closed firewall open, then this wouldn't be
> needed, but then we introduce the fun security hole of /boot/loader.conf
> munging, which is minor...  if someone can modify /boot/loader.conf, you
> have bigger fish to fry..

There's the net.inet.ip.fw.enable sysctl.

I'm also dubious about /rescue/vi;  does this actually work when / is hosed?

Ceri
--