Date: Sun, 6 Dec 2015 15:09:44 -0500 From: Jake <milios@ccsys.com> To: Anton Sayetsky <vsasjason@gmail.com> Cc: =?utf-8?Q?Lu=C3=ADs_Fernando_Schultz_Xavier_da_Silveira?= <schultz@ime.usp.br>, freebsd-questions@freebsd.org Subject: Re: OSS in jail Message-ID: <4A96B34F-EC69-4036-8D49-73C9B1E662F1@ccsys.com> In-Reply-To: <CAA2O=b_SmMh6iU8-SVjh-qHyvZf9xyxkOLc8KwrynktBvDjsbg@mail.gmail.com> References: <20151206194401.GA3860@hpmini> <CAA2O=b_isQOHepigMgDyDGtOidpbYkLOmvEayCbETfLEbUsDKA@mail.gmail.com> <20151206194958.GB4044@hpmini> <CAA2O=b_SmMh6iU8-SVjh-qHyvZf9xyxkOLc8KwrynktBvDjsbg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Dec 6, 2015, at 2:51 PM, Anton Sayetsky <vsasjason@gmail.com> wrote: >=20 > 2015-12-06 21:49 GMT+02:00 Lu=C3=ADs Fernando Schultz Xavier da Silveira > <schultz@ime.usp.br>: >> Sorry, I meant write-only mode. > If a user has write access, how do you want to prevent him to set permissi= ons? I think that's what he's asking us, the general community. Maybe not for a s= olution as simple as the standard device nodes and permissions, since he als= o described his use case as the actual goal. Without actually forming a spec= ific plan for u in detail, a setup involving network send/receive and on a s= olution such as what Jack2 (and others) provide comes to mind. That may work= for you Fernando or it may not be low-level enough to fit all your desires.= Perhaps a simpler solution using the append-only file flag would suffice an= d disallowing the jail to change flags is workable. See allow.chflags in man= 8 jail and/or man 5 jail.conf. I believe there's a global setting and a per= jail setting. I'm interested in hearing about what solutions you/we can come up with.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A96B34F-EC69-4036-8D49-73C9B1E662F1>