Re: DoS from within jail

From: Bart Matthaei (bart@dreamflow.nl)
Date: 03/31/02 

Date: Sun, 31 Mar 2002 15:09:12 +0200
From: Bart Matthaei <bart@dreamflow.nl>
To: Yonatan Bokovza <Yonatan@xpert.com>

On Sun, Mar 31, 2002 at 04:01:33PM +0300, Yonatan Bokovza wrote:
> Hi,
> Do you think it's a security issue,
> that root in jail can DoS the hosting
> server and other jails on it with a
> forkbomb ?

root in jail = root on box ..

So the answer is no.

Regards,

Bart 

-- 
Bart Matthaei                 bart@dreamflow.nl 
Eat drink and be merry, for tomorrow they may make it illegal.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: getaffinity/setaffinity and cpu sets.
    ... created in a jail such that you know whether they can be changed in a ... This anonymous set will also be inherited across fork/thread ... In this model presently there are nodes marked as root. ... One place I'd like to implement CPU affinity is in the Sun Grid Engine ...
    (freebsd-arch)
  • Re: getaffinity/setaffinity and cpu sets.
    ... The notion would be that you can create a new numbered cpuset with cpuset. ... You can modify or inspect its affinity with get/setaffinity above and the CPU_WHICH_SET argument. ... This set would not be modifiable by user processes or by processes in a jail. ... Another option would be to expel the offending thread from the set that is in violation and reparent it to the real system root along with a syslog message or similar. ...
    (freebsd-arch)
  • Re: getaffinity/setaffinity and cpu sets.
    ... created in a jail such that you know whether they can be changed in a ... This anonymous set will also be inherited across fork/thread ... In this model presently there are nodes marked as root. ... be allocated a set of cpus that they can't change, ...
    (freebsd-arch)
  • Re: chroot versus jail for the name daemon
    ... > assuming named is running as user and group bind (rather than as root)? ... > 3) What happens if named is broken while in a jail, ... That means an attacker can set things up so ...
    (freebsd-questions)
  • Re: jail() House Rock
    ... Think carefully about exactly what kind of privileges your clients get. ... normal user account on the main server, and root inside the jail. ...
    (FreeBSD-Security)