Date: Thu, 9 Nov 2006 00:48:29 -0800 (PST) From: Luke Crawford <lsc@prgmr.com> To: mal content <artifact.one@googlemail.com> Cc: Lowell Gilbert <freebsd-security-local@be-well.ilk.org>, freebsd-security@freebsd.org Subject: Re: Sandboxing Message-ID: <Pine.NEB.4.64.0611090039130.15626@luke.xen.prgmr.com> In-Reply-To: <8e96a0b90611090017x5375ed18jf3748c685ce8d2a6@mail.gmail.com> References: <8e96a0b90611080439n558022edj79febf458494ef6e@mail.gmail.com> <8e96a0b90611080441t2b486637ya10acd5a1dd77690@mail.gmail.com> <44irhq6ngd.fsf@be-well.ilk.org> <20061108142306.GA64711@owl.midgard.homeip.net> <8e96a0b90611082359jbc85b37kad6109a0aa87598@mail.gmail.com> <Pine.NEB.4.64.0611090005540.15626@luke.xen.prgmr.com> <8e96a0b90611090017x5375ed18jf3748c685ce8d2a6@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 9 Nov 2006, mal content wrote: > On 09/11/06, Luke Crawford <lsc@prgmr.com> wrote: >> man jail(8) > A full jail is quite extreme, don't you think? Besides, it'd be tricky to > allow > a jailed program to write to ~/.mozilla and /tmp. Not really. well, it would be difficult to let it write to both ~/.mozilla and /tmp unless your homedir is under /tmp, what I would do is run mozilla under ~/mozilla and use that as the jail chroot. give it an internal IP and connect via X over IP if you want... or figure out how to put the named pipe unter ~/.mozilla (I'm not going to look it up for you, but there is a way... your jail system can't write outside the jail, but your non-jail system can write into the jail, so you might even be able to do it with a simple symlink.) jail is the best sandbox FreeBSD has; if that's to heavy, simply run it setuid to another user that doesn't have permission to anything- it's not as good of a sandbox, but it's lightweight.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.4.64.0611090039130.15626>