Hacker News new | ask | show | jobs
by elehack 4253 days ago
Jails are a FreeBSD thing. OpenBSD doesn't have them so far as I know.
1 comments
doomrobo 4253 days ago
sysjail is available for OpenBSD.

>It provides a similar function as FreeBSD's jail(8) utility while being significantly more flexible. The package provides jail(1), a drop-in replacement of FreeBSD's jail(8)

http://sysjail.bsd.lv/

link
jude- 4253 days ago
sysjail is not safe for jail-like use. Sysjail'ed processes can do Bad Things by exploiting concurrency races in the syscall interception layer.

Relevant paper: http://www.watson.org/~robert/2007woot/2007usenixwoot-exploi...

link
valarauca1 4252 days ago
This paper is from 2007, is it still not fixed?
link
jude- 4252 days ago
It's my understanding that it's not fixable without some help from the kernel. The fundamental problem is that a program can race ahead of a userspace syscall policy enforcement framework (i.e. sysjail) by trapping to the kernel directly. The authors identify several ways this can be exploited to gain privileged information or invoke syscalls the OS allows but the framework tries to prevent.
link
valarauca1 4252 days ago
Did some quick googling. Yes apperently as of 2009 it was unfixed. Seems the problem is with systrace over arching architecure OR how the kernel works with systrace.

Learned something new today thanks :)

link