3 ms·
"The motivation behind the new system call has more to do with chroot environments, where the device might not be available at all. " Why wouldn't one simply c
by throwaway0010 12y ago
"The motivation behind the new system call has more to do with chroot environments, where the device might not be available at all. "
Why wouldn't one simply create the appropriate device node inside the chroot? This argument strikes me as nonsense.
- throwaway2048 12y agoit is normal for a vast amount of software to fork privsep children into /var/empty, which as name suggests, is empty. Forcing urandom to exist also precludes mounting partions 'nodev' which has secuirty implications in a chroot enviroment. Lastly, relying on a devicefile makes you prone to things like fd exhaustion attacks.