Date: Fri, 12 Jun 2009 19:30:09 +0000 (UTC) From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: Jamie Gritton <jamie@FreeBSD.org> Cc: freebsd-current@FreeBSD.org, Rick Macklem <rmacklem@uoguelph.ca> Subject: Re: kgssapi won't build, I need prison help Message-ID: <20090612192839.M22887@maildrop.int.zabbadoz.net> In-Reply-To: <4A32AAB4.8010602@FreeBSD.org> References: <Pine.GSO.4.63.0906111131001.6225@muncher.cs.uoguelph.ca> <20090611170448.M22887@maildrop.int.zabbadoz.net> <Pine.GSO.4.63.0906121454040.29219@muncher.cs.uoguelph.ca> <4A32AAB4.8010602@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 12 Jun 2009, Jamie Gritton wrote: > No, nfsd in a proson doesn't make any sense (at least to me). The NFS > server itself created its own unjailed cred, so I would expect the > auxillary stuff needs to be unjailed as well. You still may want to > use the cred's jail though - it seems there may be a chance of > permission escalation otherwise. An nfsd inside a prison (with a vnet) will make perfect sense; the code is just not there (yet). I could not see a reason why it would no longer be possible to server or (in case of nfsclient) consume NFS with a complete virtual network stack. /bz -- Bjoern A. Zeeb The greatest risk is not taking one.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090612192839.M22887>