Re: simple chroot environment rc.d script

[Thor Lancelot Simon <tls%panix.com@localhost>]

On Thu, Aug 23, 2012 at 02:47:30PM +0200, iMil wrote:
> 
> Hi,
> 
> /etc/rc.subr knows how to handle a chrooted service, but nothing is
> available yet to build a basic chrooted environment.

The built environment is much more dangerous than it needs to be, if
you're going to use null mounts.  The most obvious issue is that a 
full copy of /dev is provided to the application, when what you really
want to do is ensure the application has only the device nodes it
needs, on a read-only filesystem, and everything else accessible to
it mounted "nodev".

Thor