NetBSD-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: NetBSD Jails

On Thu, 21 May 2020, Sad Clouds wrote:
On Thu, 21 May 2020 00:17:27 -0400
"Aaron B." <> wrote:

There's still networking to worry about after that, but just isolating
processes in a more useful way is a huge step forward.

You can probably do that. If you use chroot to emulate containers,
simply partition UID and GID assignment into blocks. Each chroot gets a
unique /etc/passwd and /etc/group where IDs are offset by some value.
You just need to make sure to rebuild binary databases. This way
multiple processes that use the same user name (e.g. sshd, postfix,
httpd, etc) and are started inside chroot, run under unique IDs and
cannot send signals to one another.

There is no isolation for networking. You can assign multiple aliased
IP addresses to a single interface, but they are all visible and
accessible inside chroot. You need to be really careful about which
listening sockets you create and avoid wildcard addresses. NetBSD has
kauth(9) framework which could be use for RBAC, so potentially you could
restrict process access to specific IP addresses, but someone has to
write kernel modules and user applications that implement RBAC.

RBAC using kauth was demonstrated in a talk by Alistair Crooks at EuroBSDCon 2009. Unfortunately, any slides/recordings seem to have been expunged from the UKUUG website


Home | Main Index | Thread Index | Old Index