36 ms·

Jails are a FreeBSD thing. OpenBSD doesn't have them so far as I know.

• doomrobo 12y ago
  sysjail is available for OpenBSD. >It provides a similar function as FreeBSD's jail(8) utility while being significantly more flexible. The package provides jail(1), a drop-in replacement of FreeBSD's jail(8) http://sysjail.bsd.lv/ http://sysjail.bsd.lv/
  • jude- 12y ago
    sysjail is not safe for jail-like use. Sysjail'ed processes can do Bad Things by exploiting concurrency races in the syscall interception layer. Relevant paper: http://www.watson.org/~robert/2007woot/2007usenixwoot-exploitingconcurrency.pdf http://www.watson.org/~robert/2007woot/2007usenixwoot-exploi...
    • valarauca1 12y ago
      This paper is from 2007, is it still not fixed?
      • jude- 12y ago
        It's my understanding that it's not fixable without some help from the kernel. The fundamental problem is that a program can race ahead of a userspace syscall policy enforcement framework (i.e. sysjail) by trapping to the kernel directly. The authors identify several ways this can be exploited to gain privileged information or invoke syscalls the OS allows but the framework tries to prevent.
        • valarauca1 12y ago
          Did some quick googling. Yes apperently as of 2009 it was unfixed. Seems the problem is with systrace over arching architecure OR how the kernel works with systrace. Learned something new today thanks :)