d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a warning note to security.jail.allow_raw_sockets

Browse Source 
about the risks of enabling raw sockets in prisons.

Because raw sockets can be used to configure and interact
with various network subsystems, extra caution should be
used where privileged access to jails is given out to
untrusted parties. As such, by default this option is disabled.

A few others and I are currently auditing the kernel
source code to ensure that the use of raw sockets by
privledged prison users is safe.

Approved by:	bmilekic (mentor)
This commit is contained in:
Christian S.J. Peron 2004-06-01 00:25:44 +00:00
parent 7934cbe0d3
commit 8bac4dbf71
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=129909
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.sbin/jail/jail.8
View File

@ -419,7 +419,10 @@ is set, the source IP addresses are enforced to comply
with the IP address bound to the jail, regardless of whether or not
the
.Dv IP_HDRINCL
flag has been set on the socket.
flag has been set on the socket. Because raw sockets can be used to configure
and interact with various network subsystems, extra caution should be used
where privileged access to jails is given out to untrusted parties. As such,
by default this option is disabled.
.It Va security.jail.getfsstatroot_only
This MIB entry determines whether or not processes within a jail are able
to see data for all mountpoints.