Date: Tue, 5 Aug 2003 06:51:12 -0500 From: "Jacques A. Vidrine" <nectar@FreeBSD.org> To: Terry Lambert <tlambert2@mindspring.com> Cc: current@freebsd.org Subject: Re: Any patch for ICMP in a jail? Message-ID: <20030805115112.GA13555@madman.celabo.org> In-Reply-To: <3F2F8D3B.7542C2A1@mindspring.com> References: <Pine.NEB.3.96L.1030804083230.49165B-100000@fledge.watson.org> <a0600120fbb5404c90190@[10.0.1.2]> <3F2E9D7F.AFEFF672@mindspring.com> <20030804212340.GD10339@madman.celabo.org> <3F2F8D3B.7542C2A1@mindspring.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 05, 2003 at 03:55:55AM -0700, Terry Lambert wrote: > Through the credential passing? I thought that wasn't reliable > for this type of thing. Specifically, the jail would be in an > untrusted protection domain; if you just accepted the credential > blindly, then anyone could be root in the jail, and you could not > trust it. > > If you didn't accept it blindly, then regular root loses existing > functionality. > > I'm pretty sure that, at least the last time I looke at it, the > credential passing code didn't pass information about jail status. [deletia] Sorry, you are right. Despite the subject line, I wasn't thinking of jails at this point, but just of removing the setuid bit from ping. Cheers, -- Jacques Vidrine . NTT/Verio SME . FreeBSD UNIX . Heimdal nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030805115112.GA13555>