From owner-freebsd-security@FreeBSD.ORG  Sat Jan 20 17:02:01 2007
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 5420816A480;
	Sat, 20 Jan 2007 17:02:01 +0000 (UTC)
	(envelope-from simon@zaphod.nitro.dk)
Received: from mx.nitro.dk (zarniwoop.nitro.dk [83.92.207.38])
	by mx1.freebsd.org (Postfix) with ESMTP id 5B0A213C468;
	Sat, 20 Jan 2007 17:02:00 +0000 (UTC)
	(envelope-from simon@zaphod.nitro.dk)
Received: from zaphod.nitro.dk (unknown [192.168.3.39])
	by mx.nitro.dk (Postfix) with ESMTP id 727302D4A9E;
	Sat, 20 Jan 2007 17:01:59 +0000 (UTC)
Received: by zaphod.nitro.dk (Postfix, from userid 3000)
	id 63BB11141E; Sat, 20 Jan 2007 18:01:59 +0100 (CET)
Date: Sat, 20 Jan 2007 18:01:59 +0100
From: "Simon L. Nielsen" <simon@FreeBSD.org>
To: Stefan Bethke <stb@lassitu.de>
Message-ID: <20070120170158.GC971@zaphod.nitro.dk>
References: <200701111841.l0BIfWOn015231@freefall.freebsd.org>
	<45A6DB76.40800@freebsd.org>
	<20070113112937.GI90718@garage.freebsd.pl>
	<20070120122432.GA971@zaphod.nitro.dk>
	<178C4510-6CD1-4F32-AA41-BDB6CF35E0C3@lassitu.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <178C4510-6CD1-4F32-AA41-BDB6CF35E0C3@lassitu.de>
User-Agent: Mutt/1.5.11
Cc: freebsd-security@freebsd.org, Pawel Jakub Dawidek <pjd@freebsd.org>,
	Colin Percival <cperciva@freebsd.org>, freebsd-stable@freebsd.org
Subject: Re: Improving FreeBSD-SA-07:01.jail fix
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Jan 2007 17:02:01 -0000

On 2007.01.20 17:52:32 +0100, Stefan Bethke wrote:
> Am 20.01.2007 um 13:24 schrieb Simon L. Nielsen:
> 
> >BTW. with regard to the console.log file I really don't think it
> >should be put back inside the jail unless it's possible to make the
> >generation of the file entirely inside the jail since it's just not
> >worth the risk/complexity.
> 
> I'm probably missing something, but why not replace:
> 	_jail_id=$(head -1 ${_tmp_jail})
> 	tail +2 ${_tmp_jail} >${_rootdir}/var/log/console.log
> with:
> 	_jail_id=$(head -1 ${_tmp_jail})
> 	tail +2 ${_tmp_jail} | jexec ${_jail_id} sh -c "cat >/var/log/ 
> console.log"

I thought of, and actually implemented, a similar solution when I
worked on the problem but there are two problems:

- You cannot be sure cat exists inside the jail.
- The jail could already have exited again in which case jexec will
  fail.

-- 
Simon L. Nielsen