unprivileged users are able to kill certain jailed processes
Joseph Koshy
joseph.koshy at gmail.com
Sun Feb 5 07:30:47 PST 2006
bk> That means you have to consider that the host environment
bk> need to be trustworthy if you use jails and as long as you
bk> can't guarantee strict isolation of the host environment
bk> from the point of view of unprivileged users it would be
bk> the wrong way to obscure jails from these users
bk> partially, like I suggested.
On FreeBSD 5 and later there is mac_partition(4). You
could investigate using setpmac(8) to run processes inside
the jail with a different partition label than processes
in the host environment.
--
FreeBSD Volunteer, http://people.freebsd.org/~jkoshy
More information about the freebsd-current
mailing list