[Bug 262179] Prevent jail escaping via shared nullfs; option to disable UNIX domain socket binding

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262179

--- Comment #6 from firk@cantconnect.ru ---
It should be noted, that there are another ways to escape jail via shared
nullfs when it is done badly. I did not tried to fix them in any way, the patch
is to fix jail-escaping only for properly configured nullfs:

1) both shared mounts have exactly same underlying base directory
2) underlying base directory for nullfs is placed on a separate filesystem,
otherwise invisible to the jails.

-- 
You are receiving this mail because:
You are the assignee for the bug.