wiki:experiences:igraltist:jail_cups [RSBAC: Extending Linux Security Beyond the Limits]

Releases

Current version
Git/Latestdiff: 1.5.6

Latest Snapshots
Produced after each commit or rebase to new upstream version

GIT
RSBAC source code, can be unstable sometimes

Events

No events planned

--- cupsd_org	2008-07-14 02:28:06.000000000 +0200
+++ cupsd	2008-07-05 02:22:26.000000000 +0200
@@ -9,7 +9,7 @@
 
 start() {
 	ebegin "Starting cupsd"
-	start-stop-daemon --start --quiet --exec /usr/sbin/cupsd
+	run-jail cupsd start-stop-daemon --start --quiet --exec /usr/sbin/cupsd
 	eend $?
 }

;
; RSBAC JAIL definition for cupsd
; 20080507
;
; Tested by igraltist on gentoo
;
 
""
"0.0.0.0"
(allow-dev-read
 allow-dev-write
 allow-all-net-family
 allow-inet-raw)
()
()
(rlimit)

This is execute now:
rsbac_jail  -d -D -n -r -M  rlimit start-stop-daemon  --start --quiet --exec /usr/sbin/cupsd                                                                              [ ok ]

//