From owner-svn-src-head@FreeBSD.ORG Fri Jan 31 21:30:36 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3EEF0645; Fri, 31 Jan 2014 21:30:36 +0000 (UTC) Received: from mail.ebusiness-leidinger.de (mail.ebusiness-leidinger.de [217.11.53.44]) by mx1.freebsd.org (Postfix) with ESMTP id E05AA1B2F; Fri, 31 Jan 2014 21:30:35 +0000 (UTC) Received: from outgoing.leidinger.net (p57A386D8.dip0.t-ipconnect.de [87.163.134.216]) by mail.ebusiness-leidinger.de (Postfix) with ESMTPSA id 717FE8447C2; Fri, 31 Jan 2014 22:30:14 +0100 (CET) Received: from unknown (Titan.Leidinger.net [192.168.1.17]) by outgoing.leidinger.net (Postfix) with ESMTP id 852093D50; Fri, 31 Jan 2014 22:30:11 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=leidinger.net; s=outgoing-alex; t=1391203811; bh=eDtmS/aadUuBeSVAxDn09mbw/LQQRvS6zUf7C9jzC6Y=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=1P1T9EDeHYDqwdsqUOvPY24oqJkcPWDibwh80KPE2NnIOBcioMDsfICaL8/r5pSNO IhJPBBsaB9t/HYgeQuvmU+kCGSYk3K+kHyfHtuF46Klmr0wY5U689Yx8Y7718j/wub fEvQf5eny8wTjU8PVLTJ0IfXz2Y+tQZiCU+AevzqZnFGVPCnDvysRhaCtwdHeYvrYm huZsXULuE2cqW1qqMiuFYYRCL6iZx6G/A1xYBIv/uWuMiNWH7I7aloaSm336yi9Wn7 yOsZ6WXLwtAtUyq7aR8Z+EQr1nLn4IWbvSQFKA78azbJcHLvC9YWa6E1FNPhjKGYQA WeH24hs3CLiQA== Date: Fri, 31 Jan 2014 22:30:11 +0100 From: Alexander Leidinger To: Robert Watson Subject: Re: svn commit: r261266 - in head: sys/dev/drm sys/kern sys/sys usr.sbin/jail Message-ID: <20140131223011.0000163b@unknown> In-Reply-To: References: <201401291341.s0TDfDcB068211@svn.freebsd.org> <20140129134344.GW66160@FreeBSD.org> <52E906CD.9050202@freebsd.org> <20140129222210.0000711f@unknown> X-Mailer: Claws Mail 3.9.2-55-g74b05b (GTK+ 2.16.6; i586-pc-mingw32msvc) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-EBL-MailScanner-Information: Please contact the ISP for more information X-EBL-MailScanner-ID: 717FE8447C2.A1587 X-EBL-MailScanner: Found to be clean X-EBL-MailScanner-SpamCheck: not spam, spamhaus-ZEN, SpamAssassin (not cached, score=-1.059, required 6, autolearn=disabled, ALL_TRUSTED -1.00, AWL -0.11, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10, RP_MATCHES_RCVD -0.00, TW_EV 0.08, TW_SV 0.08) X-EBL-MailScanner-From: alexander@leidinger.net X-EBL-MailScanner-Watermark: 1391808614.88144@go6+FBEnTfXX/mVxxtfMbQ X-EBL-Spam-Status: No Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, Gleb Smirnoff , src-committers@freebsd.org, James Gritton X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jan 2014 21:30:36 -0000 On Fri, 31 Jan 2014 12:34:48 +0000 (GMT) Robert Watson wrote: > On Wed, 29 Jan 2014, Alexander Leidinger wrote: > > >> It does. I included a warning in jail.8 that this will pretty > >> much undo jail security. There are still reasons some may want to > >> do this, but it's definitely not for everyone or even most people. > > > > It only "unjails" (= basically the same security level as the > > jail-host with the added benefit of the flexibility of a jail like > > easy moving from one system to another) the jail which has this > > flag set. All other jails without the flag can not "escape" to the > > host. > > > > I also have to add that just setting this flag does not give access > > to the host, you also have to configure a non-default devfs rule > > for this jail (to have the devices appear in the jail). > > This is not correct: devices do not need to be delegated in devfs for > PRIV_IO to allow bypass of the Jail security model, due to sysarch() > and the Linux-emulated equivalent, which turn out direct I/O access > from a user process without use of a device node. Ok, then it is just the non-default flag, not the additional devfs part. I agree with your other post that we are better of to document better what it means if an admin allows kmem access for a specific jail. Bye, Alexander. -- http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID = B0063FE7 http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID = 72077137