Jail, outstanding details

Martin Blix Grydeland martin at varnish-software.com
Thu Feb 19 11:00:13 CET 2015


On 18 February 2015 at 20:19, Poul-Henning Kamp <phk at phk.freebsd.dk> wrote:

> In message <E1YOA12-0001ej-54 at project.varnish-software.com>, Poul-Henning
> Kamp
> writes:
>
> >    Move creation of workdir into jail code, and use the master HIGH/LOW
> >    around socket operations which may be on reserved ports.
>
> This is all presuming jail=unix which means Varnish was started as root.
>
> I am uncertain if creating/opening the storage files should be done
> at "MASTER_HIGH" (= root) or "MASTER_LOW" (= varnish user) privilege
> level.
>

We've been looking at the option of having block device as storage instead
of going through the filesystem. These devices usually have special rules
setting up the permissions and such on each boot, making it useful to be
root to avoid permission problems when opening the device. (Changing the
rules to assign the device to the specified user is probably the "right"
way of doing things though).

Martin




>
> I'm sort of leaning "MASTER_HIGH" on general principles, but if anybody
> has input, I'd like to hear it...
>
> --
> Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
> phk at FreeBSD.ORG         | TCP/IP since RFC 956
> FreeBSD committer       | BSD since 4.3-tahoe
> Never attribute to malice what can adequately be explained by incompetence.
>
> _______________________________________________
> varnish-dev mailing list
> varnish-dev at varnish-cache.org
> https://www.varnish-cache.org/lists/mailman/listinfo/varnish-dev
>



-- 
<http://varnish-software.com>*Martin Blix Grydeland*
Senior Developer | Varnish Software AS
Mobile: +47 992 74 756
We Make Websites Fly!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-dev/attachments/20150219/e7fe9175/attachment.html>


More information about the varnish-dev mailing list