Call for a hacker.... security.bsd.see_other_uids in jails only

[Alex Semenyaka]

On Fri, May 21, 2004 at 01:24:56PM +0000, Bjoern A. Zeeb wrote:
> >> A more general solution will be better, but harder to implement: make
> >> some sysctl branches (e.g. security.bsd) local per jail, and possibility to
> >> change them only from host machine.
>> I like the idea of per-jail sysctl MIB trees, e.g.:
>> jail.<JID>.security.bsd
> jail ID is not too good; we would need s.th. that could be treated
> 'perstistent' between reboots.

Well, we can invent the jail naming like

jail -N foo ...
jail -N bar ...

Then the first jail will have name ``foo'' and second one will be ``bar''
and the names will not depend on JIDs. Also we can require that name should
start with letter, not digit so we always will know if we are dealing with a
JID or with a name. And if jail has the name the corresponding sysctl subtree
will be ``jail.<NAME>'', otherwise ``jail.<JID>''.

Names are persistent between reboots so a problem disappears.

Looks like it is easy to implement as well. Could it be a right way to go?

Sicerely,
Alex Semenyaka