[lkml]   [2002]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: more thoughts on a new jail() system call
On Fri, Jul 19, 2002 at 12:21:47AM +0000, you [David Wagner] wrote:
> Shaya Potter wrote:
> >sys_mknod) J - Need FIFO ability, everything else not.
> Beware the ability to pass file descriptors across Unix
> domain sockets. This should probably be restricted somehow.
> Along similar lines, you didn't mention sendmsg() and
> recvmsg(), but the fd-passing parts should probably be
> restricted.

I gather FreeBSD allow passing fd's, but not in or out the jail. Just inside

> >sys_setuid16) ^J - since jail is secure, can setuid all you want.
> I'd look very carefully at whether root can bypass any
> of the access controls you're relying on. For instance,
> with root, one can bind to ports below 1024.

In FreeBSD jail, jailed root is supposed to be safe. So if something is
jailed - and has the necessary privileges - it can bind to the jail ip (each
jail has its own ip). But it can't bind to any other ip's of the box.

> >sys_socketcall) J - Bind seems to be the only problem. jail() includes
> >an ip address, and a jailed process can only bind to that address. so
> >do we force the addr to be this address, or does one allow INADDR_ANY
> >and translate that to the jail'd ip address?

In FreeBSD, INADDR_ANY is explicitly translated to jail's IP. Many daemons
use INADDR_ANY routinely, so I think it makes sense.

> >sys_syslog) NOT SURE (probably jailed away)
> sys_syslog touches a global shared resource, hence
> should probably be denied to jailed processes.

Ummh, most logical way would be to create an own syslog for each jail.
That's also the most laborous alternative, though...

-- v --
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:27    [W:0.096 / U:3.284 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site