Date: Fri, 21 May 2004 12:45:57 +0300 From: Alex Lyashkov <shadow@psoft.net> To: Pawel Jakub Dawidek <pjd@FreeBSD.org> Cc: Ruslan Ermilov <ru@FreeBSD.org> Subject: Re: Call for a hacker.... security.bsd.see_other_uids in jails only Message-ID: <1085132756.24958.68.camel@berloga.shadowland> In-Reply-To: <20040521094119.GB845@darkness.comp.waw.pl> References: <20040520220145.GN4567@genius.tao.org.uk> <20040521080218.GY845@darkness.comp.waw.pl> <20040521090217.GB57989@ip.net.ua> <20040521094119.GB845@darkness.comp.waw.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
=F7 =F0=D4=CE, 21.05.2004, =D7 12:41, Pawel Jakub Dawidek =D0=C9=DB=C5=D4: > On Fri, May 21, 2004 at 12:02:17PM +0300, Ruslan Ermilov wrote: > +> I like the idea of per-jail sysctl MIB trees, e.g.: > +>=20 > +> jail.<JID>.security.bsd > +>=20 > +> When jail gets created, the generic sysctl code would traverse > +> the primary sysctl tree (excluding the jail. subtree), and copy > +> and attach those that have some jail-related flag to the > +> jail.<JID>. branch. > +>=20 > +> Inside the jail, jail.<JID>.security.bsd branch would map to > +> just security.bsd. > +>=20 > +> The generic sysctl code, when it detects it's run within a > +> jail, will find a sysctl node "foo.bar", and if it has a > +> jail-clone flag set, will remap a query to jail.<JID>.foo.bar. > +>=20 > +> Whether it's allowed to change a particular sysctl inside > +> a jail is another matter. >=20 > There are two main issues with our current sysctls implementation: > 1. We cannot hide sysctls/sysctl-trees. > 2. We're operating in most cases on integers. >=20 > We can work on 1, but we can't hack 2 easly, we have to transform > sysctls, that have to be treated on per-jail basics from SYSCTL_INT > to SYSCTL_PROC and if so, I'm not sure what for do we need > security.jail.<JID> trees then. We can implement them in the same > way security.jail.jailed is impelemented (it shows different value > outside a jail and different inside) and if we want to change it: >=20 > # jexec <JID> /sbin/sysctl <some_sysctl>=3D<some_value> >=20 > Of course, there could be no /sbin/sysctl utility inside a jail, > but I'll still suggest to add '-j' option to sysctl command to > work just like 'killall -j' (i.e. jail_attach(<JID>); sysctl();). killall -j =3D bad idea.. It not kill fork bomb started inside jail. for protect from this situations me must have jail command for stop jail and kill all tasks inside. --=20 Alex Lyashkov <shadow@psoft.net> PSoft
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1085132756.24958.68.camel>