Security Implications for GUIjail with nullfs and xhost +
reddit / freebsd

----------------------------------------------------------------------
bawdyanarchist · 2020-09-02 00:45

In exploration of "jail/bhyve everything for security," I have
successfully jailed the NIC (soon instead to bhyve with PCI
passthrough), and jailed a VPN tunnel. I'm now considering 2 options
for GUI jails:

1. `ssh -Y` between host/jail (definitely secure)
2. `mount_nullfs /tmp/.X11-host` to my jails, with xhost +

Since I jailed the NIC, blocked all traffic to the host, and don't
intend to X Forward outside of the physical machine/host, I have this
naive hope that ssh is unnecessary and no more secure than option #2.

Is this correct? Or are multiple GUI jails simultaneously sharing
/tmp/.X11-unix a recipe for security vulnerabilities?

Bonus: Does the answer change depending of if I intend to set up a
forward facing server like IPFS, Tor relay, or I2P?

----------------------------------------------------------------------
rob2g2 · 2020-09-02 22:09

you could also use xephyr and/or jailme