DragonFly kernel List (threaded) for 2009-07
priv(9) - Removal of PRISON_ROOT flag
The PRISON_ROOT flag is gone now, which could be passed to
priv_check_cred() to allow a privilege within a jail (this meant that
the root user within a jail was allowed to perform a certain operation).
As such, what is allowed within a jail was spread over all calls to
priv_check_cred(). This knownledge is now defined purely within
prison_priv_check(), which checks whether a given privilege is allowed
within a jail or not (this function should not be called directly! it is
called by priv_check_cred()).
So for example if you want to know whether raw IP sockets are allowed
within a jail, simply take a look at prison_priv_check(), where you will
see the following code:
Then do a search over the whole source tree for PRIV_NETINET_RAW to see
where this privilege is requested.