[lkml]   [2005]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectBSD jail
    I had been wanting this functionality myself, but for some reason it never found
    its way into the stock kernel. I looked around, started coding,
    looked some more,
    coded some more, looked some more until I found this:

    I suppose the reason it wasn't applied is lack of good IPv6 support.

    It is perhaps about what I was looking for, but a slightly different method.
    My idea was to cause no disturbance to the normal security chain, and
    so maintain jails in the following manner (remember, the sys_jail call
    is trusted)
    1. Add an additional check to path_lookup (actually, a functioned
    called by path_lookup)
    to check for jail roots in addition to normal chroots.
    2. Lockdown process visibility to only processes in the same jail.
    3. Lockdown kill/ptrace/setpriority to processes in the same jail.
    4. Lockdown capabilities to a restricted set that prevents novel
    means of breaking the jail.
    5. Restrict binding to one IPv4 and one IPv6 address (squash bind to
    all to bind to that).
    All of this is done in front of the normal security mechansim, so that
    some non-default
    security module will not accidentally break this.

    I provided compatability for exactly the BSD jail(2) call, but did it
    without breaking
    programs that depend on chroot escapes working (there are a few).

    I am currently about a third of the way to completion. This means that
    I will finish
    unless some other mechanism is provided before I do. I personally
    don't care if my
    patch is used (if released), but I want this functionality.
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-08-13 02:49    [W:0.019 / U:42.124 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site