kern/55568: DUMP has access to block devices in a JAIL

[Kris Kennaway]

The following reply was made to PR kern/55568; it has been noted by GNATS.

From: Kris Kennaway <kris at obsecurity.org>
To: mjoyner <mjoyner at rv1.dynip.com>
Cc: Kris Kennaway <kris at obsecurity.org>,
	FreeBSD-gnats-submit at FreeBSD.org
Subject: Re: kern/55568: DUMP has access to block devices in a JAIL
Date: Wed, 8 Oct 2003 20:52:38 -0700

 --EeQfGwPcQSOJBaQU
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 Content-Transfer-Encoding: quoted-printable
 
 On Wed, Oct 08, 2003 at 11:33:50PM -0400, mjoyner wrote:
 > Where would one find documentation to prevent the jailed user from being=
 =20
 > able to dump the raw partition(s)?
 
 jails containing untrusted root users should only contain a minimum
 set of device nodes (the exact list would depend on what you want to
 do with the jail).  This is documented in the manpage.
 
 
 Kris
 
 --EeQfGwPcQSOJBaQU
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.2.3 (FreeBSD)
 
 iD8DBQE/hNuGWry0BWjoQKURAo61AJ98v98CVfCWSFqcHKIjGgC1WD/XZgCg0jX5
 mMwXmLzWH2/ksK8VoN3rtHo=
 =Rzej
 -----END PGP SIGNATURE-----
 
 --EeQfGwPcQSOJBaQU--