From owner-freebsd-questions@freebsd.org  Thu Dec 10 14:49:31 2015
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id CBA369D7E3C
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Thu, 10 Dec 2015 14:49:31 +0000 (UTC)
 (envelope-from mfi@tf.uni-kiel.de)
Received: from mhost.tf.uni-kiel.de (mhost.tf.uni-kiel.de [134.245.247.71])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 8E7BA1159
 for <freebsd-questions@freebsd.org>; Thu, 10 Dec 2015 14:49:31 +0000 (UTC)
 (envelope-from mfi@tf.uni-kiel.de)
Received: from amavis.tf.uni-kiel.de (unknown [192.168.247.79])
 by mhost.tf.uni-kiel.de (Postfix) with ESMTP id 8CBD813A5D50;
 Thu, 10 Dec 2015 15:40:17 +0100 (CET)
X-Virus-Scanned: amavisd-new at tf.uni-kiel.de
Received: from mhost.tf.uni-kiel.de ([134.245.247.71])
 by amavis.tf.uni-kiel.de (amavis.tf.uni-kiel.de [192.168.247.79]) (amavisd-new,
 port 10025)
 with ESMTP id M5CkB0komJRM; Thu, 10 Dec 2015 15:40:08 +0100 (CET)
Received: from fanty-a.tf.uni-kiel.de (fanty.tf.uni-kiel.de [134.245.247.132])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits)) (No client certificate requested)
 by mhost.tf.uni-kiel.de (Postfix) with ESMTPS id 45A6813A5D4C;
 Thu, 10 Dec 2015 15:40:08 +0100 (CET)
Received: (from mfi@localhost)
 by fanty-a.tf.uni-kiel.de (8.14.9/8.14.9/Submit) id tBAEe8fw022009;
 Thu, 10 Dec 2015 15:40:08 +0100 (CET) (envelope-from mfi)
Date: Thu, 10 Dec 2015 15:40:08 +0100
From: Michael Firnau <mfi@tf.uni-kiel.de>
To: Aleksandr Miroslav <alexmiroslav@gmail.com>
Cc: freebsd-questions@freebsd.org
Subject: Re: best practice for locking down private jail?
Message-ID: <20151210144007.GA23555@fanty-a.tf.uni-kiel.de>
References: <CACcSE1yQO8AjW9rpY+d2p1-ArPbO4qKV0zcaCMyRhYEWLOpQGA@mail.gmail.com>
 <20151203073923.17dae0c41a2b5e29a5b3a3dd@sohara.org>
 <CACcSE1zhMLnbo+bOixOM_ZLBpP+szbmzfFH_12v36ezy34fs9g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACcSE1zhMLnbo+bOixOM_ZLBpP+szbmzfFH_12v36ezy34fs9g@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Dec 2015 14:49:31 -0000

On Thu, Dec 03, 2015 at 06:45:16PM -0800, Aleksandr Miroslav wrote:
> On Wed, Dec 2, 2015 at 11:39 PM, Steve O'Hara-Smith <steve@sohara.org> wrote:
> > I would set up two jails - one as the upload jail the other the web
> > server and use a cron job on the host to move verified mp3 files
> 
> Excellent advice, I will do just that.

I think the cron job isn't needed. Create a directory outside the jails
and mount it as nullfs and 'rw' into the upload jail and 'ro' into the
web server jail. We do this on a zfs basis.