From owner-freebsd-hackers@FreeBSD.ORG Sun Dec 31 04:59:53 2006 Return-Path: X-Original-To: freebsd-hackers@freebsd.org Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id EB94D16A407 for ; Sun, 31 Dec 2006 04:59:53 +0000 (UTC) (envelope-from cperciva@freebsd.org) Received: from pd4mo2so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.freebsd.org (Postfix) with ESMTP id C025F13C441 for ; Sun, 31 Dec 2006 04:59:53 +0000 (UTC) (envelope-from cperciva@freebsd.org) Received: from pd4mr6so.prod.shaw.ca (pd4mr6so-qfe3.prod.shaw.ca [10.0.141.69]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0JB40063OGJTRCC0@l-daemon> for freebsd-hackers@freebsd.org; Sat, 30 Dec 2006 21:59:53 -0700 (MST) Received: from pn2ml10so.prod.shaw.ca ([10.0.121.80]) by pd4mr6so.prod.shaw.ca (Sun Java System Messaging Server 6.2-2.05 (built Apr 28 2005)) with ESMTP id <0JB4009UDGJT5PB0@pd4mr6so.prod.shaw.ca> for freebsd-hackers@freebsd.org; Sat, 30 Dec 2006 21:59:53 -0700 (MST) Received: from hexahedron.daemonology.net ([24.82.18.31]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with SMTP id <0JB400GK7GJSQB20@l-daemon> for freebsd-hackers@freebsd.org; Sat, 30 Dec 2006 21:59:53 -0700 (MST) Received: (qmail 32191 invoked from network); Sun, 31 Dec 2006 04:59:47 +0000 Received: from unknown (HELO ?127.0.0.1?) (127.0.0.1) by localhost with SMTP; Sun, 31 Dec 2006 04:59:47 +0000 Date: Sat, 30 Dec 2006 20:59:47 -0800 From: Colin Percival In-reply-to: <20061229090146.d2bc2b1c.wmoran@collaborativefusion.com> To: Bill Moran Message-id: <459743C3.90801@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Enigmail-Version: 0.94.0.0 References: <20061229120030.3DCE316A530@hub.freebsd.org> <45950CFD.5020506@freebsd.org> <20061229090146.d2bc2b1c.wmoran@collaborativefusion.com> User-Agent: Thunderbird 1.5.0.9 (X11/20061227) Cc: freebsd-hackers@freebsd.org Subject: Re: Modified version of jexec allows non-root access into jails X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Dec 2006 04:59:54 -0000 Bill Moran wrote: > You also describe a scenerio where a user can create a jail of his own > design and give himself root inside it, thus allowing him to use the > setuid trick to get root on the host as well. The place this falls down > is that the user would need to already have root to create the jail in the > first place. Not necessarily. An unprivileged user can create hard links to binaries he doesn't own, including suid binaries. Colin Percival