Date: Wed, 27 Jul 2011 22:19:14 -0400 From: Jason Hellenthal <jhell@DataIX.net> To: Glen Barber <gjb@freebsd.org> Cc: svn-src-stable@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, svn-src-stable-8@freebsd.org Subject: Re: svn commit: r224462 - stable/8/usr.sbin/jail Message-ID: <20110728021914.GA55550@DataIX.net> In-Reply-To: <201107270156.p6R1uquD035835@svn.freebsd.org> References: <201107270156.p6R1uquD035835@svn.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--OgqxwSJOaUobr8KG Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 27, 2011 at 01:56:52AM +0000, Glen Barber wrote: > Author: gjb (doc committer) > Date: Wed Jul 27 01:56:52 2011 > New Revision: 224462 > URL: http://svn.freebsd.org/changeset/base/224462 >=20 > Log: > MFC 224286: > =20 > Document the potential for jail escape. > =20 > PR: 142341 >=20 > Modified: > stable/8/usr.sbin/jail/jail.8 > Directory Properties: > stable/8/usr.sbin/jail/ (props changed) >=20 > Modified: stable/8/usr.sbin/jail/jail.8 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > --- stable/8/usr.sbin/jail/jail.8 Tue Jul 26 20:51:58 2011 (r224461) > +++ stable/8/usr.sbin/jail/jail.8 Wed Jul 27 01:56:52 2011 (r224462) > @@ -34,7 +34,7 @@ > .\" > .\" $FreeBSD$ > .\" > -.Dd January 17, 2010 > +.Dd July 23, 2011 > .Dt JAIL 8 > .Os > .Sh NAME > @@ -913,3 +913,10 @@ Currently, the simplest answer is to min > offered on the host, possibly limiting it to services offered from > .Xr inetd 8 > which is easily configurable. > +.Sh NOTES > +Great care should be taken when managing directories visible within the = jail. > +For example, if a jailed process has its current working directory set t= o a > +directory that is moved out of the jail's chroot, then the process may g= ain > +access to the file space outside of the jail. > +It is recommended that directories always be copied, rather than moved, = out > +of a jail. How is either one of these different ? All mv(1) is doing is a cp(1) & rm(1). In either case the filehandle is still broken and a process is not going to just get up and move with it. On the other side though if you copied a pipe or socket or something similiar for example into a jail then it might make whatever is outside available to the jailed environment. Is there something I am misunderstanding about this ? has the way cp(1), rm(1) & mv(1) been changed recently ? or is this wording a little off ? --OgqxwSJOaUobr8KG Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (FreeBSD) Comment: http://bit.ly/0x89D8547E iQEcBAEBAgAGBQJOMMcfAAoJEJBXh4mJ2FR+cJcH/A8lNW6rpTBgk7WgnOHO/grV kXcSIveh+MBkfoxt9F65Mt7RMroIXSpk2pvg9upNVjuMDNTfCkRuNnPK6NgwptDp BSq9bSzeQW08aQRwB0ARaaEyNpXJh0aqV4GkYHel9vBqNd6Jwc1dAtriIJIJQhgC rRRdtOJEJ2f1Xc5x1k0Ikg4vULxbvKlVhe1K92gHRJlf7I67TZstH1UsgsD9u/wh OvSj49Xh0ND0CzB5VY6imqvxLGCyc4a6F5vXdh/5uNfyWnkxXuT7MpFNmosoVCK4 qNHPzZuWHrhyqi4+bF8YjAm8ZfdtMNbaHRiH+u7QVp/xmjVA4G/JnuZtthIOeYY= =pela -----END PGP SIGNATURE----- --OgqxwSJOaUobr8KG--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110728021914.GA55550>