Re: SHM objects cannot be isolated in jails, any evolution in future FreeBSD versions?

2016-03-19 Thread Mateusz Guzik
On Sat, Mar 12, 2016 at 12:05:57PM +0100, Simon wrote: > The shm_open()(2) function changed since FreeBSD 7.0: the SHM objects > path are now uncorrelated from the physical file system to become > just abstract objects. Probably due to this, the jail system do not > provide any form of filtering re

Re: SHM objects cannot be isolated in jails, any evolution in future FreeBSD versions?

2016-03-19 Thread Simon
Le 2016-03-15 09:34, Miroslav Lachman a écrit : Mark Felder wrote on 03/14/2016 22:07: On Sat, Mar 12, 2016, at 11:42, James Gritton wrote: On 2016-03-12 04:05, Simon wrote: The shm_open()(2) function changed since FreeBSD 7.0: the SHM objects path are now uncorrelated from the physical file

Re: SHM objects cannot be isolated in jails, any evolution in future FreeBSD versions?

2016-03-19 Thread Dewayne Geraghty
Mateusz, Anything that you can do to address this, would be greatly appreciated. Thanks for taking the time to have another look. Having a globally accessible namespace is a potential vulnerability where multiple sendmail &/or postgresql clusters are running. Its not unreasonable to have: - a (s