From owner-freebsd-jail@FreeBSD.ORG Mon May 5 12:27:24 2014 Return-Path: Delivered-To: freebsd-jail@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BF54B952 for ; Mon, 5 May 2014 12:27:24 +0000 (UTC) Received: from mail-ob0-x233.google.com (mail-ob0-x233.google.com [IPv6:2607:f8b0:4003:c01::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 8960817C5 for ; Mon, 5 May 2014 12:27:24 +0000 (UTC) Received: by mail-ob0-f179.google.com with SMTP id gq1so651289obb.38 for ; Mon, 05 May 2014 05:27:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=krTm321d2NjoMhBsy2F+EwAol6A2r/WPyJBU8L1RSUs=; b=b0Bw8m0+hWTwszCazxc2Nl+ZuMbLc5c9bA3CM6ECC5NsWMBbpwC6zZmQcvJs/Nrgsf fXCxnkwXUONi6miztPeg5xKC5tlxeDzAtzXgbO40gzO4ogGlBx6x4f1/Y6L5+Tx0Jat3 WluOKTJhuDCUi4h9vHO33c1m4YTqiThmp60heFOj1UX/SDzOGk1BRNRN3HE31bSda2Xf x4mEDmxKvbHM4+q5FtR8eJttvLhwLqggT0stHsMBKEPcS0uckpMyAIODUWXxPBEoyVwh 0n5pgkIKNNh3kWOrTXVp41cbmcc392kHYbCpEMoxkc5hVKyPHcR8nI26D9hcDRLeWsfU IEBQ== MIME-Version: 1.0 X-Received: by 10.60.132.236 with SMTP id ox12mr1366514oeb.81.1399292843735; Mon, 05 May 2014 05:27:23 -0700 (PDT) Received: by 10.76.173.229 with HTTP; Mon, 5 May 2014 05:27:23 -0700 (PDT) In-Reply-To: <20140505195852.140ddb1b@X220.alogt.com> References: <20140505195852.140ddb1b@X220.alogt.com> Date: Mon, 5 May 2014 14:27:23 +0200 Message-ID: Subject: Re: Can Firefox break out of a jail From: Andreas Nilsson To: Erich Dollansky Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18 Cc: Mailinglists FreeBSD X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 May 2014 12:27:24 -0000 On Mon, May 5, 2014 at 1:58 PM, Erich Dollansky wrote: > Hi, > > I do some experimenting with jails at the moment on a FreeBSD 10.0 > machine. The jails are all setup manually according to the handbook and > man jail. Each jail gets a name and an IP address. Individual ports are > then installed via the ports tree. > > X is running on the host system. Telnet is used to connect to the jails. > > When I install now firefox in a jail and also in the host system, I get > the following behaviour. > > Scene A > > Firefox runs already on the host system. I start then firefox inside > the jail firefox. It all seems fine as long as I do not use the history > or want to save the visited page. The jailed firefox sees then the > history of the firefox running on the host. > > Scene B > > Firefox is first started inside the jail firefox. When then the host > system also starts a firefox, this firefox sees now the history and the > filesystem of the jailed firefox. > > Is it X that allows the jailed firefox to communicate directly with > firefox running directly on the host? > > Is there then a way to secure the system? > > I have tried then programs like gedit or kate and saw only the > behaviour I expected. Both programs either saw only resources from > inside the jail or from outside but never resources from the other side > of the fence. > > Erich > Firefox is a strange beast in regarads to running it on a remote host. It needs to be started as firefox --no-remote to not find "local running" instance and connect to it. How that happens I don't know... Best regards Andreas