In message <[EMAIL PROTECTED]>, Warner Losh writes:
>In message <[EMAIL PROTECTED]> Jordan Hubbard writes:
>: Couldn't you also do "mount -t devfs -o nonewdev devfs /home/jail/dev"
>: and then cd /home/jail/dev ; rm $devices_i_dont_want_in_my_jails ?  It
>: seems that "read my lips: no new devices" should be an option you can
>: set from the very initial mount so that people can't also figure out
>: how to get root, remove a /dev entry and replace it with one of their
>: own.  Come to think of it, there should also be a -o staticdev option
>: to disallow *any* changes after the initial mount.  That would make
>: some of our more paranoid sysadmins happy.
>My concern is that I usually know what devices I want (/dev/null,
>/dev/zero, /dev/tty).  That makes it harder to delete all of them not
>on the list.

I have seriously been thinking about some way to say something like
        mount -t devfs -o jailset /home/jail/dev
but an elegant implementation evades me at this moment.

And again, it hinges on an extensible set of mount options.

Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[EMAIL PROTECTED]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message

Reply via email to