kgssapi won't build, I need prison help
Rick Macklem
rmacklem at uoguelph.ca
Fri Jun 12 19:54:35 UTC 2009
On Fri, 12 Jun 2009, Bjoern A. Zeeb wrote:
> On Fri, 12 Jun 2009, Jamie Gritton wrote:
>
>> No, nfsd in a proson doesn't make any sense (at least to me). The NFS
>> server itself created its own unjailed cred, so I would expect the
>> auxillary stuff needs to be unjailed as well. You still may want to
>> use the cred's jail though - it seems there may be a chance of
>> permission escalation otherwise.
>
> An nfsd inside a prison (with a vnet) will make perfect sense; the
> code is just not there (yet). I could not see a reason why it would
> no longer be possible to server or (in case of nfsclient) consume NFS
> with a complete virtual network stack.
>
So, is getcredhostid(curthread->td_ucred) sound ok as a way to get it
working, at least for now?
And is adding getcredhostid() a reasonable patch?
Thanks for the help, rick
More information about the freebsd-current
mailing list