upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Clarify an explanation a little bit.

Browse source
This commit is contained in:
Poul-Henning Kamp 1999-07-09 21:35:37 +00:00
parent 4466b0f0ab
commit 38edd9beb9
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/libc/sys/jail.2
View file

@ -6,7 +6,7 @@
.\"this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
.\"----------------------------------------------------------------------------
.\"
.\"$Id: jail.2,v 1.2 1999/05/16 10:51:42 phk Exp $
.\"$Id: jail.2,v 1.3 1999/06/17 23:43:35 green Exp $
.\"
.\"
.Dd April 28, 1999
@ -53,11 +53,16 @@ the prison. It is not possible to add a process to a preexisting prison.
.Pp
Inside the prison, the concept of "superuser" is very diluted. In general,
it can be assumed that nothing can be mangled from inside a prison which
doesn't exist inside that prison (ie: the directory tree below
.Dq Li path .
doesn't exist entirely inside that prison. For instance the directory
tree below
.Dq Li path
can be manipulated all the ways a root can normally do it, including
.Dq Li "rm -rf /*"
but new device special notes cannot be created because the reference
shared resources (the device drivers in the kernel).
.Pp
All IP activity will be forced to happen to/from the IP number specified,
which should be an alias on one of the systems interfaces.
which should be an alias on one of the network interfaces.
.Pp
It is possible to identify a process as jailed by examining
.Dq Li /proc/<pid>/status :