From nobody Thu Aug 22 19:07:05 2024
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WqXkn2sFKz5TSst
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Thu, 22 Aug 2024 19:07:13 +0000 (UTC)
	(envelope-from doug@safeport.com)
Received: from fledge.watson.org (fledge.watson.org [147.160.157.40])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "A1-48603", Issuer "A1-48603" (not verified))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4WqXkm4Z4Dz4KYk
	for <freebsd-questions@freebsd.org>; Thu, 22 Aug 2024 19:07:12 +0000 (UTC)
	(envelope-from doug@safeport.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: from fledge.watson.org (doug@localhost [127.0.0.1])
	by fledge.watson.org (8.17.1/8.17.1) with ESMTPS id 47MJ76Aq020616
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO);
	Thu, 22 Aug 2024 19:07:06 GMT
	(envelope-from doug@safeport.com)
Received: from localhost (doug@localhost)
	by fledge.watson.org (8.17.1/8.17.1/Submit) with ESMTP id 47MJ75ev020610;
	Thu, 22 Aug 2024 19:07:06 GMT
	(envelope-from doug@safeport.com)
X-Authentication-Warning: fledge.watson.org: doug owned process doing -bs
Date: Thu, 22 Aug 2024 19:07:05 +0000 (UTC)
From: doug <doug@safeport.com>
Reply-To: doug@safeport.com
To: Andrea Venturoli <ml@netfence.it>
cc: freebsd-questions@freebsd.org
Subject: Re: security.bsd.see_other_uids/gids and jails
In-Reply-To: <902826c1-fc50-48aa-867d-8010b5814df2@netfence.it>
Message-ID: <61ed9412-563-a5f-a3c0-66ff23cb5ac4@safeport.com>
References: <902826c1-fc50-48aa-867d-8010b5814df2@netfence.it>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
X-Spamd-Bar: ----
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:6405, ipnet:147.160.157.0/24, country:US]
X-Rspamd-Queue-Id: 4WqXkm4Z4Dz4KYk

On Thu, 22 Aug 2024, Andrea Venturoli wrote:

> Hello.
>
> Is there any way to set security.bsd.see_other_uids and 
> security.bsd.see_other_gids per jail?
>
> I'd like to keep them to 0 for better security, but I've got a couple of 
> software that requires one or the other.
> Since those software are in their own jail, is it possible to disable them 
> globally, but allow them only in those jail?
>
> Guess the answer is no :(, but I thought I'd ask...
>
> bye & Thanks
> 	av.
>
>
The rules of the road here are: make an effort to answer the question, 
which I doing anyway:

echo 'security.bsd.see_other_uids=0' >> /etc/sysctl.conf
echo 'security.bsd.see_other_gids=0' >> /etc/sysctl.conf

This assume you installed FreeBSD. During installation you are asked if you 
want to do this.