Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Robert Watson
On Mon, 30 Nov 2009, xorquew...@googlemail.com wrote: jackd (audio/jack) creates a directory in /tmp with a UNIX domain socket in it. Clients connect to this socket to communicate with the server. We currently support the sharing of UNIX domain sockets between file system layers on either

Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Robert Watson
On Mon, 30 Nov 2009, Ivan Voras wrote: What's the sane solution, then, when the only method of communication is unix domain sockets? It is a security problem. I think the long-term solution would be to add a sysctl analogous to security.jail.param.securelevel to handle this. I don't think

Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Robert Watson
On Tue, 1 Dec 2009, Linda Messerschmidt wrote: On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's the sane solution, then, when the only method of communication is unix domain sockets? It is a security problem. I think the long-term solution would be to add a

Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Robert Watson
On Thu, 10 Dec 2009, Robert Watson wrote: On Mon, 30 Nov 2009, xorquew...@googlemail.com wrote: jackd (audio/jack) creates a directory in /tmp with a UNIX domain socket in it. Clients connect to this socket to communicate with the server. We currently support the sharing of UNIX domain

Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Ivan Voras
2009/12/10 Robert Watson rwat...@freebsd.org: On Tue, 1 Dec 2009, Linda Messerschmidt wrote: On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's the sane solution, then, when the only method of communication is unix domain sockets? It is a security problem. I

Re: UNIX domain sockets on nullfs still broken?

2009-12-10 Thread Robert N. M. Watson
On 10 Dec 2009, at 09:59, Ivan Voras wrote: You have a point there. I was actually thinking more of sysvshm - which doesn't have anything to do with any of the issues here - but has some of the same properties (and is also used by databases - e.g. postgresql, which I'm using daily so it sort

Re: UNIX domain sockets on nullfs still broken?

2009-12-03 Thread Alexander Leidinger
Quoting Julian Elischer jul...@elischer.org (from Wed, 02 Dec 2009 09:43:25 -0800): Alexander Leidinger wrote: Quoting Linda Messerschmidt linda.messerschm...@gmail.com (from Tue, 1 Dec 2009 10:22:02 -0500): On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's

Re: UNIX domain sockets on nullfs still broken?

2009-12-02 Thread Alexander Leidinger
Quoting Linda Messerschmidt linda.messerschm...@gmail.com (from Tue, 1 Dec 2009 10:22:02 -0500): On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's the sane solution, then, when the only method of communication is unix domain sockets? It is a security problem. I

Re: UNIX domain sockets on nullfs still broken?

2009-12-02 Thread Julian Elischer
Alexander Leidinger wrote: Quoting Linda Messerschmidt linda.messerschm...@gmail.com (from Tue, 1 Dec 2009 10:22:02 -0500): On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's the sane solution, then, when the only method of communication is unix domain sockets?

Re: UNIX domain sockets on nullfs still broken?

2009-12-01 Thread Alexander Leidinger
Quoting Ivan Voras ivo...@freebsd.org (from Mon, 30 Nov 2009 16:14:40 +0100): xorquew...@googlemail.com wrote: On 2009-11-30 15:43:01, Ivan Voras wrote: xorquew...@googlemail.com wrote: 76030 initial thread STRU struct sockaddr { AF_LOCAL, /tmp/jack-11001/default/jack_0 } 76030 initial

Re: UNIX domain sockets on nullfs still broken?

2009-12-01 Thread xorquewasp
On 2009-12-01 09:32:56, Alexander Leidinger wrote: My workaround with MySQL is to have the jail and the socket in the same FS (I would prefer to have them on separate FS). Then you can do a hardlink of the socket into the jail (obviously after each restart of the software, but this can

Re: UNIX domain sockets on nullfs still broken?

2009-12-01 Thread Linda Messerschmidt
On Mon, Nov 30, 2009 at 10:14 AM, Ivan Voras ivo...@freebsd.org wrote: What's the sane solution, then, when the only method of communication is unix domain sockets? It is a security problem. I think the long-term solution would be to add a sysctl analogous to security.jail.param.securelevel

UNIX domain sockets on nullfs still broken?

2009-11-30 Thread xorquewasp
jackd (audio/jack) creates a directory in /tmp with a UNIX domain socket in it. Clients connect to this socket to communicate with the server. $ jackd -d oss -r 44100 -p 128 $ ls -alF /tmp/jack-11001/default total 4 drwx-- 2 xw wheel 512 30 Nov 14:19 ./ drwx-- 3 xw wheel 512 30 Nov

Re: UNIX domain sockets on nullfs still broken?

2009-11-30 Thread Ivan Voras
xorquew...@googlemail.com wrote: jackd (audio/jack) creates a directory in /tmp with a UNIX domain socket in it. Clients connect to this socket to communicate with the server. $ jackd -d oss -r 44100 -p 128 $ ls -alF /tmp/jack-11001/default total 4 drwx-- 2 xw wheel 512 30 Nov 14:19 ./

Re: UNIX domain sockets on nullfs still broken?

2009-11-30 Thread xorquewasp
On 2009-11-30 15:43:01, Ivan Voras wrote: xorquew...@googlemail.com wrote: 76030 initial thread STRU struct sockaddr { AF_LOCAL, /tmp/jack-11001/default/jack_0 } 76030 initial thread NAMI /tmp/jack-11001/default/jack_0 76030 initial thread RET connect -1 errno 61 Connection

Re: UNIX domain sockets on nullfs still broken?

2009-11-30 Thread Ivan Voras
xorquew...@googlemail.com wrote: On 2009-11-30 15:43:01, Ivan Voras wrote: xorquew...@googlemail.com wrote: 76030 initial thread STRU struct sockaddr { AF_LOCAL, /tmp/jack-11001/default/jack_0 } 76030 initial thread NAMI /tmp/jack-11001/default/jack_0 76030 initial thread RET connect

Re: UNIX domain sockets on nullfs still broken?

2009-11-30 Thread Vlad Galu
On Mon, Nov 30, 2009 at 5:01 PM, xorquew...@googlemail.com wrote: On 2009-11-30 15:43:01, Ivan Voras wrote: xorquew...@googlemail.com wrote:  76030 initial thread STRU  struct sockaddr { AF_LOCAL, /tmp/jack-11001/default/jack_0 }  76030 initial thread NAMI  /tmp/jack-11001/default/jack_0