in reply to Re: un-installing perl core modules inside a freebsd jail
in thread un-installing perl core modules inside a freebsd jail

So you're saying a plain directory removal will work without breaking anything else. I mean perl itself won't stop running or anything, just that module will vanish?
  • Comment on Re^2: un-installing perl core modules inside a freebsd jail

Replies are listed 'Best First'.
Re^3: un-installing perl core modules inside a freebsd jail
by shmem (Chancellor) on Feb 20, 2013 at 10:23 UTC
    I mean perl itself won't stop running or anything, just that module will vanish?

    Yes. Perl code which tries to load a vanished module will fail with the usual

    Can't locate Vanished/Module.pm in @INC (@INC contains: ... ) BEGIN failed--compilation aborted.

    which means that perl is working fine :)

Re^3: un-installing perl core modules inside a freebsd jail
by tmharish (Friar) on Feb 20, 2013 at 10:24 UTC

    Well there are a bunch of modules that can access the net ( if thats what you are trying to block ) and this thread has some ways to find all modules installed.

    Regarding Perl breaking - I cannot think of any core module that allows for access to the internet ( and so removal of that will break the system ); Since I am not a 100% sure, you should, like I said earlier, keep them in a different location just so you can put them back if your OS were to break - you can do that from the main system.

      I think the low level networking functions (socket, bind, listen, connect) are built in to Perl. If that is the case, then you can't prevent internet access by removing modules. I'm not a freebsd person, but perhaps a more complete approach would be to address this via OS and network.

        Agreed -- from a security point of view, it makes much more sense just to block networking in general for this process.

        Alex / talexb / Toronto

        "Groklaw is the open-source mentality applied to legal research" ~ Linus Torvalds

        Yep. I plan on using a freebsd jail with no ip support at all. So I've got that covered already. :) Was just thinking of pushing it