svn commit: r336731 - projects/bectl/sbin/bectl

[Shawn Webb]

On Thu, Jul 26, 2018 at 08:47:30AM -0500, Kyle Evans wrote:
> On Thu, Jul 26, 2018 at 8:32 AM, Rodney W. Grimes
> <freebsd at pdx.rh.cn85.dnsmgr.net> wrote:
> > -- Start of PGP signed section.
> >> On Thu, Jul 26, 2018 at 04:07:37AM +0000, Kyle Evans wrote:
> >> > Author: kevans
> >> > Date: Thu Jul 26 04:07:36 2018
> >> > New Revision: 336731
> >> > URL: https://svnweb.freebsd.org/changeset/base/336731
> >> >
> >> > Log:
> >> >   bectl(8): Redo jail using jail(3) API
> >> >
> >> >   The jail is created with allow.mount, allow.mount.devfs, and
> >> >   enforce_statfs=1. Upon creation, we immediately attach, chdir to "/", and
> >> >   drop the user into a shell inside the jail.
> >> >
> >> >   The default IP for this is arbitrarily 10.20.30.40.
> >>
> >> It seems this would only allow working in a single jailed BE at a
> >> time, correct?
> >
> > Also it is just bad practice to use arbitrary IP's from
> > rfc1918 space.   IMHO it would be better to pick a
> > rfc3927 link local address, or one of the rfc5737 test
> > network addresses.
> >
> > Please see RFC5735 page 6, table in section 4, no
> > place in FreeBSD base system should we be shipping
> > stuff that uses rfc1918, that is private space that
> > does not belong to the OS.
> >
> 
> Right on both accounts (Shawn + Rod)... I changed it from an arbitrary
> IP in 192.168/16 space that was conflicting with my local network
> (heh... that was fun) with the intent of later changing it to just be
> configurable rather than hard-coding an IP [1] because I think that no
> matter what choice I try to go with, someone's going to want something
> else. I'd rather not make such choices at all and force you to instead
> specify an IP every time, a la "bectl jail testenv 10.8.0.100".

Or perhaps to jail the BE without an IP at all. Sometimes all I want
to do before rebooting into a new BE is just set an rc.conf value
(disable a service, for example).

Also, as we look forward to IPv6, it would be nice if IPv6 was
supported as well.

> 
> The default remains 10.20.30.40 until that time, though, and it seemed
> that anyone wanting to test this should be aware.
> 
> [1] see the "XXX TODO" I dropped in the area, which mentions the
> former and meant to hint at the latter

-- 
Shawn Webb
Cofounder and Security Engineer
HardenedBSD

Tor-ified Signal:    +1 443-546-8752
Tor+XMPP+OTR:        lattera at is.a.hacker.sx
GPG Key ID:          0x6A84658F52456EEE
GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89  3D9E 6A84 658F 5245 6EEE
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/svn-src-projects/attachments/20180726/c50c3943/attachment.sig>