From owner-freebsd-stable@FreeBSD.ORG  Thu Sep  3 12:21:40 2009
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 57E481065676;
	Thu,  3 Sep 2009 12:21:40 +0000 (UTC) (envelope-from jhb@freebsd.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 281998FC13;
	Thu,  3 Sep 2009 12:21:40 +0000 (UTC)
Received: from bigwig.baldwin.cx (66.111.2.69.static.nyinternet.net
	[66.111.2.69])
	by cyrus.watson.org (Postfix) with ESMTPSA id CC6D446B2A;
	Thu,  3 Sep 2009 08:21:39 -0400 (EDT)
Received: from jhbbsd.hudson-trading.com (unknown [209.249.190.8])
	by bigwig.baldwin.cx (Postfix) with ESMTPA id 1B6FC8A043;
	Thu,  3 Sep 2009 08:21:39 -0400 (EDT)
From: John Baldwin <jhb@freebsd.org>
To: freebsd-stable@freebsd.org
Date: Thu, 3 Sep 2009 08:08:07 -0400
User-Agent: KMail/1.9.7
References: <ff6efe7e0909011230i414b6791k707f5c58383e9b53@mail.gmail.com>
	<20090902160440.GA28417@sd-13813.dedibox.fr>
	<4A9E98AD.1070202@FreeBSD.org>
In-Reply-To: <4A9E98AD.1070202@FreeBSD.org>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200909030808.08440.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0.1
	(bigwig.baldwin.cx); Thu, 03 Sep 2009 08:21:39 -0400 (EDT)
X-Virus-Scanned: clamav-milter 0.95.1 at bigwig.baldwin.cx
X-Virus-Status: Clean
X-Spam-Status: No, score=-1.5 required=4.2 tests=AWL,BAYES_00,RDNS_NONE
	autolearn=no version=3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on bigwig.baldwin.cx
Cc: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>,
	FLEURIOT Damien <ml@my.gd>, Doug Barton <dougb@freebsd.org>,
	freebsd-jail@freebsd.org
Subject: Re: Not getting an IPv6 in a jail
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Sep 2009 12:21:40 -0000

On Wednesday 02 September 2009 12:09:17 pm Doug Barton wrote:
> FLEURIOT Damien wrote:
> 
> > BIND's now happily running in its jail and responding to public
> > queries.
> 
> It's up to you if you choose to do it, but there is no reason to run
> BIND in a jail. The chroot feature provided by default by rc.d/named
> is quite adequate security.

That is debatable.  One of the chief benefits of a jail is that if a server is 
compromised so that an attacker can gain root access that root access is 
limited in what it can do compared to a simple chroot.  That is true for any 
server you would run under a jail, not just BIND.

-- 
John Baldwin