Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 4 Jul 2012 21:45:54 +0100
From:      Attilio Rao <attilio@freebsd.org>
To:        David Chisnall <theraven@freebsd.org>
Cc:        src-committers@freebsd.org, Pawel Jakub Dawidek <pjd@freebsd.org>, svn-src-all@freebsd.org, Konstantin Belousov <kostikbel@gmail.com>, svn-src-head@freebsd.org, Andrey Chernov <ache@freebsd.org>, markm@freebsd.org
Subject:   Re: svn commit: r238118 - head/lib/libc/gen
Message-ID:  <CAJ-FndAGgkgi5W3LqgMkeK9AquQ=1RhhYcj4jnLmuRg2EwVuqA@mail.gmail.com>
In-Reply-To: <8344944B-1CEE-4CAD-96FB-EC5A743F6909@FreeBSD.org>
References:  <201207041951.q64JpPXu029310@svn.freebsd.org> <20120704200220.GM2337@deviant.kiev.zoral.com.ua> <20120704203239.GA42326@vniz.net> <8344944B-1CEE-4CAD-96FB-EC5A743F6909@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
2012/7/4 David Chisnall <theraven@freebsd.org>:
> On 4 Jul 2012, at 21:32, Andrey Chernov wrote:
>
>> 1) /dev/urandom may not exist in jails/sandboxes while sysctls (or old w=
ay
>> initialization) always exists.
>
> From the perspective of Capsicum sandboxes, a device node is better than =
a sysctl.  The kernel must hard-code policy about which sysctls are permitt=
ed, but access to file descriptors is decided on a per-sandbox basis and is=
 configurable by the user.  The same applies to jails, although it's slight=
ly more effort to make device nodes appear inside a jail.

Also don't understimate the locking factor here.
I recall that at some point /dev/random was introducing some
scalability penalty on php (maybe related to the suhosin patch) until
kib made shared lookups available on devfs. IIRC, sysctls are still
Giant locked.

Attilio


--=20
Peace can only be achieved by understanding - A. Einstein



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ-FndAGgkgi5W3LqgMkeK9AquQ=1RhhYcj4jnLmuRg2EwVuqA>