[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: simple chroot environment rc.d script
On Thu, Aug 23, 2012 at 02:47:30PM +0200, iMil wrote:
> /etc/rc.subr knows how to handle a chrooted service, but nothing is
> available yet to build a basic chrooted environment.
The built environment is much more dangerous than it needs to be, if
you're going to use null mounts. The most obvious issue is that a
full copy of /dev is provided to the application, when what you really
want to do is ensure the application has only the device nodes it
needs, on a read-only filesystem, and everything else accessible to
it mounted "nodev".
Main Index |
Thread Index |