summaryrefslogtreecommitdiffstats
path: root/lib/libc
diff options
context:
space:
mode:
authorjamie <jamie@FreeBSD.org>2010-10-20 21:19:36 +0000
committerjamie <jamie@FreeBSD.org>2010-10-20 21:19:36 +0000
commit0f098ddf66a41d1fb5d4de184e52ad91ae6b2477 (patch)
treef7ef45325d394e4251ebdb4de6bd9d6b8bf3836f /lib/libc
parentb7cbd895d180129e2f1712f7ac2d6a6006080536 (diff)
downloadFreeBSD-src-0f098ddf66a41d1fb5d4de184e52ad91ae6b2477.zip
FreeBSD-src-0f098ddf66a41d1fb5d4de184e52ad91ae6b2477.tar.gz
Remove a section that went to jail(8), and fix a small grammar error.
Diffstat (limited to 'lib/libc')
-rw-r--r--lib/libc/sys/jail.240
1 files changed, 1 insertions, 39 deletions
diff --git a/lib/libc/sys/jail.2 b/lib/libc/sys/jail.2
index bf6218c..74b0dde 100644
--- a/lib/libc/sys/jail.2
+++ b/lib/libc/sys/jail.2
@@ -247,44 +247,6 @@ They return \-1 on failure, and set
to indicate the error.
.Pp
.Rv -std jail_attach jail_remove
-.Sh PRISON?
-Once a process has been put in a prison, it and its descendants cannot escape
-the prison.
-.Pp
-Inside the prison, the concept of
-.Dq superuser
-is very diluted.
-In general,
-it can be assumed that nothing can be mangled from inside a prison which
-does not exist entirely inside that prison.
-For instance the directory
-tree below
-.Dq Li path
-can be manipulated all the ways a root can normally do it, including
-.Dq Li "rm -rf /*"
-but new device special nodes cannot be created because they reference
-shared resources (the device drivers in the kernel).
-The effective
-.Dq securelevel
-for a process is the greater of the global
-.Dq securelevel
-or, if present, the per-jail
-.Dq securelevel .
-.Pp
-All IP activity will be forced to happen to/from the IP number specified,
-which should be an alias on one of the network interfaces.
-All connections to/from the loopback address
-.Pf ( Li 127.0.0.1
-for IPv4,
-.Li ::1
-for IPv6) will be changed to be to/from the primary address
-of the jail for the given address family.
-.Pp
-It is possible to identify a process as jailed by examining
-.Dq Li /proc/<pid>/status :
-it will show a field near the end of the line, either as
-a single hyphen for a process at large, or the name currently
-set for the prison for jailed processes.
.Sh ERRORS
The
.Fn jail
@@ -413,7 +375,7 @@ and
.Fn jail_attach
call
.Xr chroot 2
-internally, so it can fail for all the same reasons.
+internally, so they can fail for all the same reasons.
Please consult the
.Xr chroot 2
manual page for details.
OpenPOWER on IntegriCloud