Re: Capsicum project: Ideas needed

2011-07-09 Thread Gabor Kovesdan
Em 08-07-2011 13:23, Ivan Voras escreveu: On 08/07/2011 05:42, Ilya Bakulin wrote: Hi hackers, As a part of ongoing effort to enhance usage of Capsicum in FreeBSD base system, I want to ask you, which applications in the base system should receive sandboxing support. How about a small descript

Re: Capsicum project: Ideas needed

2011-07-09 Thread Gleb Kurtsou
On (09/07/2011 15:54), Gabor Kovesdan wrote: > Em 08-07-2011 13:23, Ivan Voras escreveu: > > On 08/07/2011 05:42, Ilya Bakulin wrote: > >> Hi hackers, > >> As a part of ongoing effort to enhance usage of Capsicum in FreeBSD base > >> system, I want to ask you, which applications in the base system

Re: Capsicum project: Ideas needed

2011-07-09 Thread Doug Barton
On 07/09/2011 07:54, Gabor Kovesdan wrote: > Anyway, consider sendmail and BIND. I think these are important enough > to get some more protection. What additional protection could capsicum offer beyond chroot'ing? (That's not a snark, I don't quite understand all the moving parts here.) Doug --

Re: [PATCH] __FreeBSD_kernel__

2011-07-09 Thread Warner Losh
I know this is a little late, but... On Jul 5, 2011, at 2:12 PM, Ed Maste wrote: > On Tue, Jul 05, 2011 at 02:05:27PM -0400, Alexander Kabaev wrote: > >> I agree with all of the above reasons, but none of them change the fact >> that __linux__ is used left and right to identify both kernel and >

Re: [PATCH] __FreeBSD_cc_version in

2011-07-09 Thread Warner Losh
On Jul 5, 2011, at 7:36 AM, Robert Millan wrote: > 2011/7/5 Dimitry Andric : >> As far as I can see, this code only gives warnings when compiled with >> gcc 4.5 or higher, and when using the -Wundef flag. Isn't it easier to >> just remove the -Wundef flag here? > > Here's a patch to remove -Wun

Re: Jails: Setting different times in jails

2011-07-09 Thread Warner Losh
Why on earth would you want this? Warner On Jul 7, 2011, at 2:31 AM, grarpamp wrote: >> possibly achievable in libc? > > I don't know. Where else would it be done? > stat, utimes, gettimeofday, clock_gettime, > adjtime, etc and their variations. > > I've not checked what currently happens, but