system/serenity
system/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2024-09-06 08:56:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Base: Add a description about Jails to the Mitigations(7) document

Browse source 
We add a new document entry to mention jailed processes' restrictions,
so it is clear which restrictions apply when using Jails.
This commit is contained in:
Liav A 2022-11-11 14:25:42 +02:00 committed by Andrew Kaster
parent 95d8aa2982
commit 756d2a7f63
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
Base/usr/share/man/man7/Mitigations.md
View file

@ -90,6 +90,33 @@ Date: Mon Jan 20 22:12:04 2020 +0100
Kernel: Add a basic implementation of unveil()
```
### Jails
`jails` are mitigation originating from FreeBSD.
It allows a program to be placed inside a lightweight OS-level virtualization environment.
Current restrictions on jailed processes:
- Process ID view isolation, being limited (both in `/proc` and `/sys/kernel/processes`) to only processes that share the same jail.
Special restrictions on filesystem also apply:
- Write access is forbidden to the `/sys/kernel/power_state` node.
- Read accesses is forbidden by default to all nodes in `/sys/kernel` directory, except for:
`df`, `interrupts`, `keymap`, `memstat`, `processes`, `stats` and `uptime`.
- Write access is forbidden to kernel variables (which are located in `/sys/kernel/variables`).
It was first added in the following [commit](https://github.com/SerenityOS/serenity/commit/5e062414c11df31ed595c363990005eef00fa263),
for kernel support, and the following commits added basic userspace utilities:
```
commit 5e062414c11df31ed595c363990005eef00fa263
Author: Liav A <liavalb@gmail.com>
Date: Wed Nov 2 22:26:02 2022 +0200
Kernel: Add support for jails
...
```
### Readonly atexit
[Readonly atexit](https://isopenbsdsecu.re/mitigations/atexit_hardening/) is a mitigation originating from OpenBSD.