9front - general discussion about 9front
 help / color / mirror / Atom feed
From: Jacob Moody <moody@mail.posixcafe.org>
To: 9front@9front.org
Subject: Re: [9front] [PATCH] Unmount to remove sharp devices.
Date: Wed, 4 May 2022 11:55:37 -0600	[thread overview]
Message-ID: <67c5f9b0-7152-7c2f-dd4d-e3354f4e9aff@posixcafe.org> (raw)
In-Reply-To: <93d9e23ef139bbf6@orthanc.ca>

On 5/4/22 11:41, Lyndon Nerenberg (VE7TFX/VE6BBM) wrote:
>> git/serve? rc-httpd? maybe some other daemons
>> could use some sandboxing.
> 
> The FTP and TFTP servers are obvious targets. But what would be
> really cool is if this could be integrated into the namespace
> files. That way you could set up the namespace for something like
> FTP, and then remove the ability to mount #foo without having to
> touch the FTP code itself. I could see myself using this all over
> the place.
> 
> --lyndon

This is already true to some extent as is with this patch.
Adding an 'unmount #e' to your namespace file will remove
access to #e as is. However I want to look a bit more
at doing the inverse operation, so you could say something like
"permit #e #| #p" and have it block all non listed
devices in the namespace file. I think that is more useful
to think about and avoids 10 lines of manually selecting drivers
to shoot.

Perhaps a new /lib/namespace.service could become the default
for networked services. Either way, with the kernel
modifications passing the sniff test, I will spend some
time seeing how to integrate this change in to existing daemons.

Thanks,
moody

  reply	other threads:[~2022-05-04 17:59 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-04 14:09 Jacob Moody
2022-05-04 15:05 ` ori
2022-05-04 15:31 ` ori
2022-05-04 16:15   ` Stanley Lieber
2022-05-04 17:41   ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2022-05-04 17:55     ` Jacob Moody [this message]
2022-05-05  1:59       ` Alex Musolino
2022-05-05 16:07         ` Jacob Moody
2022-05-08  2:55           ` Jacob Moody
2022-05-11 14:47             ` Jacob Moody
2022-05-11 16:11               ` Stanley Lieber
2022-05-12  4:29                 ` Jacob Moody
2022-05-12  3:18             ` ori
2022-05-12  5:10               ` Jacob Moody
2022-05-12 14:21                 ` ori
2022-05-23  5:42                   ` Jacob Moody
2022-05-23 17:06                     ` cinap_lenrek
2022-05-23 17:37                       ` Jacob Moody
2022-05-25 19:03                         ` Jacob Moody
2022-05-25 20:53                           ` hiro
2022-05-25 21:20                             ` Jacob Moody
2022-05-26  5:55                               ` Jacob Moody
2022-05-26 23:36                                 ` unobe
2022-05-27  0:33                                   ` Jacob Moody
2022-05-27  3:25                                     ` unobe
2022-05-26  3:13                             ` ori
2022-05-27  1:11                           ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2022-05-27  2:25                             ` Frank D. Engel, Jr.

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=67c5f9b0-7152-7c2f-dd4d-e3354f4e9aff@posixcafe.org \
    --to=moody@mail.posixcafe.org \
    --cc=9front@9front.org \
    --subject='Re: [9front] [PATCH] Unmount to remove sharp devices.' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).