Process Isolation on NetBSD with chroot(2)

https://lemmy.ml/post/43479214

I'm slowly getting myself back to having a personal website.

First blog post is up. Trying to write an intro post felt weird, so I just wrote a technical article. It's about how I set up the chroot that caddy and anubis run in on the server (running #NetBSD 10.1):

https://overeducated-redneck.net/blurgh/netbsd-chroot-isolation.html

Just added another sensor to #sysinspect — "procnotify".

In this very short demo: as long as a new process is "bash" (use "zsh", LOL), #sysinspect SIGKILLs it.

Key points:
1. procnotify detects a new process
2. a model is getting triggered (in this case just a process killer)

Currently:
Native: #linux, #netbsd
Others: external fallback path.

While writing my article, it became clear to me how much responsibility — and especially experience — is required to touch areas like UVM or NPF inside NetBSD.

I’ve learned a lot over the past weeks. But I’m also honest enough to say: I don’t yet have the depth of experience needed to modify those subsystems responsibly.

So I made a conscious decision.

I’ve created a new experimental branch for secmodel_jail / jailctl / jailmgr that is strictly additive:

- No changes to existing kernel code paths

- No UVM hooks

- No NPF integration

- No hidden coupling between subsystems

It adds new code only.

The reason is simple: even without deep UVM or NPF integration, the security model already delivers significant practical value for me. And in this reduced, explicit form, the attack surface is clear and the audit scope sharply defined.

This feels like the right first alpha candidate: understandable, bounded, and reversible.

https://github.com/MatthiasPetermann/netbsd-src/tree/feature/jails-v1-ga

#netbsd