Date: Wed, 26 Feb 2003 09:05:09 +0100 From: Pawel Jakub Dawidek <nick@garage.freebsd.pl> To: Mooneer Salem <mooneer@translator.cx> Cc: FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: Jail seperation patch Message-ID: <20030226080509.GZ8455@garage.freebsd.pl> In-Reply-To: <FHEMJMOKKMJDGKFOHHEPMEJOFCAA.mooneer@translator.cx> References: <FHEMJMOKKMJDGKFOHHEPMEJOFCAA.mooneer@translator.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
--Jsn5+Lu/ZvzbAGtZ Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Feb 25, 2003 at 02:47:11PM -0800, Mooneer Salem wrote: +> I've been working on extending the jail feature of FreeBSD to make it +> more friendly to VPS providers. I added the following features: +>=20 +> * Rudimentary CPU/RAM/number of processes per-jail limits +> * Multiple IP support (from Pawel Jakub Dawidek's mijail patch for 4.7) +> * Proper INADDR_ANY support added (so INADDR_ANY will bind to all IP +> addresses +> within a jail) And what when we got situation like: 1. main host ips: 1.1.1.2, 1.1.1.3, 1.1.1.4 jailed host ips: 1.1.1.2, 1.1.1.3 Daemon in jail binds to INADDR_ANY to port X, somebody connects to port X, but to IP 1.1.1.4 (outside jail). Connection will success? 2. main host ips: 1.1.1.2, 1.1.1.3, 1.1.1.4 jailed host ips: 1.1.1.2, 1.1.1.3 Daemon outside jail binds to port X on IP 1.1.1.4. User in jail connects to port X to INADDR_ANY. Connection will success? What when daemon idside jail and daemon outside jail binds to those same port? If I'm connectin to this port who will handle connection? +> * struct prison added to SysV IPC code (to allow for secure use) Better solution is created separated memory zones for main host and every jail, look at my patch agains 5.0-CURRENT: http://garage.freebsd.pl/privipc.tbz=20 http://garage.freebsd.pl/privipc.README +> * Disk mount hiding Better way is IMHO hiding and cutting pathnames, look at: http://garage.freebsd.pl/jailfsstat.tgz http://garage.freebsd.pl/jailfsstat.README +> * Hot add/remove IP addresses from jail using sysctl +> * Process hiding (non-root users outside jails cannot see jailed process= es) This isn't a complete solution and I think it couldn't be, because you still could modify files owned by jailed users with UID notjailed user, so.= .. +> The patch is for 5.0-CURRENT/5.0-RELEASE. I would be interested in +> any comments or suggestions. If anyone's interested, it can be retrieved +> at http://msalem.translator.cx/dist/jail_seperation.v5.patch. You could add multi-level jailing, IMHO it's cool: http://garage.freebsd.pl/mljail.tbz http://garage.freebsd.pl/mljail.README Nice work, I'm wondering if something will be ever commited:) --=20 Pawel Jakub Dawidek UNIX Systems Administrator http://garage.freebsd.pl Am I Evil? Yes, I Am. --Jsn5+Lu/ZvzbAGtZ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPlx1NT/PhmMH/Mf1AQEwTwP/VjOI5aQsxYBb7s7sV46TJqcfDKuu1tOn 0jvjYq7hgsLBvkDpLPfjovYUkCh0qhDSyc0nEDfsGaZLZIB07Hrktx+Pbux003gc znL6Iu44LTStfCqMgsboGqjCqdOpncxgYV0kxc5eBLyd9P3H3irv+RaA5JSEqWN4 DB1CbcUYWfQ= =x4FH -----END PGP SIGNATURE----- --Jsn5+Lu/ZvzbAGtZ-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030226080509.GZ8455>