Jail & SYSVIPC & postgres
From: Marton Kenyeres (mkenyeres@konvergencia.hu)
Date: 12/24/02
- Next message: Harry Tabak: "Bystander shot by a spam filter."
- Previous message: Ruslan Ermilov: "Static ARP (was: Re: NOARP - gateway must answer and have frozen ARP table)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 24 Dec 2002 09:51:12 +0100 From: Marton Kenyeres <mkenyeres@konvergencia.hu> To: security@freebsd.org
Hi!
I'm in a middle of building a server which will run Apache + PHP + Postgresql
along with a few basic services as DNS, SMTP and POP3. I plan to put the
web-related services, the e-mail related services and BIND in 3 separate
jail-s. Unfortunately PostgreSQL depends heavily on shared memory, so if I
plan to use it in a jail i have to turn the jail.sysvipc_allowed sysctl on.
One more addition: the jails are bind to aliases on the loopback interface
and the connections are NAT-ed to the outer interface. The main benefit of
this (apart from not paying $$-s for additional IP-addresses :) is that
no service runs as root as they don't have to bind to their usual priviledged
ports.
From the developers handbook:
"On most systems, this sysctl is set to 0. If it were set to 1, it would
defeat the whole purpose of having a jail; privleged users from within the jail
would be able to affect processes outside of the environment. "
My question is:
Do I really shoot myself in the foot with allowing SYSVIPC in the jails,
if there are absolutely no processes runing as root inside the jails, nor
there are any suid programs ?
Any help, advice etc. greatly appreciated,
cheerz:
m.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
- Next message: Harry Tabak: "Bystander shot by a spam filter."
- Previous message: Ruslan Ermilov: "Static ARP (was: Re: NOARP - gateway must answer and have frozen ARP table)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
