I have been researching this topic where each jail is also confined in it's own MAC Partition. So far I have found a single example of this (setpmac support patch on github)
However I'm also wondering if it's needed - jails do provide a strong security boundary, but there is also value in defense in depth if there was to be a jail exploit.
So I have two questions:
- First, is this worth pursuing?
- Second, has anyone setup jails with MAC partitions and has a working example?
However I'm also wondering if it's needed - jails do provide a strong security boundary, but there is also value in defense in depth if there was to be a jail exploit.
So I have two questions:
- First, is this worth pursuing?
- Second, has anyone setup jails with MAC partitions and has a working example?