tech-userlevel archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: simple chroot environment rc.d script

On Thu, Aug 23, 2012 at 02:47:30PM +0200, iMil wrote:
> Hi,
> /etc/rc.subr knows how to handle a chrooted service, but nothing is
> available yet to build a basic chrooted environment.

The built environment is much more dangerous than it needs to be, if
you're going to use null mounts.  The most obvious issue is that a 
full copy of /dev is provided to the application, when what you really
want to do is ensure the application has only the device nodes it
needs, on a read-only filesystem, and everything else accessible to
it mounted "nodev".


Home | Main Index | Thread Index | Old Index