Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by valarauca1 | Hacker News Reader

Parent Full thread

valarauca1·

Docker originated from BSD Jails which basically give you Chroot on steroids.

The synchronization likely won't 100% work, with cron script you maybe able to just do that with git.

View on HN

Jails are a FreeBSD thing. OpenBSD doesn't have them so far as I know.

sysjail is available for OpenBSD.

>It provides a similar function as FreeBSD's jail(8) utility while being significantly more flexible. The package provides jail(1), a drop-in replacement of FreeBSD's jail(8)

http://sysjail.bsd.lv/

sysjail is not safe for jail-like use. Sysjail'ed processes can do Bad Things by exploiting concurrency races in the syscall interception layer.

Relevant paper: http://www.watson.org/~robert/2007woot/2007usenixwoot-exploi...

This paper is from 2007, is it still not fixed?

It's my understanding that it's not fixable without some help from the kernel. The fundamental problem is that a program can race ahead of a userspace syscall policy enforcement framework (i.e. sysjail) by trapping to the kernel directly. The authors identify several ways this can be exploited to gain privileged information or invoke syscalls the OS allows but the framework tries to prevent.

Did some quick googling. Yes apperently as of 2009 it was unfixed. Seems the problem is with systrace over arching architecure OR how the kernel works with systrace.

Learned something new today thanks :)

Reply on news.ycombinator.com