summaryrefslogtreecommitdiffstats
path: root/usr.sbin
diff options
context:
space:
mode:
authorcperciva <cperciva@FreeBSD.org>2005-02-08 21:31:11 +0000
committercperciva <cperciva@FreeBSD.org>2005-02-08 21:31:11 +0000
commit30beb7d8e4b1fdb77e1c6f609b79c8d9d2e387cf (patch)
tree0024f1770569c434b08f85294b067e0e7ad79755 /usr.sbin
parente64e9f38d4432ab314933f6b9faf86fa3c0c778f (diff)
downloadFreeBSD-src-30beb7d8e4b1fdb77e1c6f609b79c8d9d2e387cf.zip
FreeBSD-src-30beb7d8e4b1fdb77e1c6f609b79c8d9d2e387cf.tar.gz
Add a new sysctl, "security.jail.chflags_allowed", which controls the
behaviour of chflags within a jail. If set to 0 (the default), then a jailed root user is treated as an unprivileged user; if set to 1, then a jailed root user is treated the same as an unjailed root user. This is necessary to allow "make installworld" to work inside a jail, since it attempts to manipulate the system immutable flag on certain files. Discussed with: csjp, rwatson MFC after: 2 weeks
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/jail/jail.89
1 files changed, 9 insertions, 0 deletions
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8
index 1a75f31..f7c5198 100644
--- a/usr.sbin/jail/jail.8
+++ b/usr.sbin/jail/jail.8
@@ -497,6 +497,15 @@ within a jail would be able to communicate with (and potentially interfere
with) processes outside of the jail, and in other jails.
As such, this functionality is disabled by default, but can be enabled
by setting this MIB entry to 1.
+.It Va security.jail.chflags_allowed
+This MIB entry determines how a privileged user inside a jail will be
+treated by
+.Xr chflags 2 .
+If zero, such users are treated as unprivileged, and are unable to set
+or clear system file flags; if non-zero, such users are treated as
+privileged, and may manipulate system file flags subject to the usual
+constaints on
+.Va kern.securelevel .
.El
.Pp
There are currently two MIB related variables that have per-jail settings.
OpenPOWER on IntegriCloud