Date: Sat, 20 Jan 2007 18:01:59 +0100 From: "Simon L. Nielsen" <simon@FreeBSD.org> To: Stefan Bethke <stb@lassitu.de> Cc: freebsd-security@freebsd.org, Pawel Jakub Dawidek <pjd@freebsd.org>, Colin Percival <cperciva@freebsd.org>, freebsd-stable@freebsd.org Subject: Re: Improving FreeBSD-SA-07:01.jail fix Message-ID: <20070120170158.GC971@zaphod.nitro.dk> In-Reply-To: <178C4510-6CD1-4F32-AA41-BDB6CF35E0C3@lassitu.de> References: <200701111841.l0BIfWOn015231@freefall.freebsd.org> <45A6DB76.40800@freebsd.org> <20070113112937.GI90718@garage.freebsd.pl> <20070120122432.GA971@zaphod.nitro.dk> <178C4510-6CD1-4F32-AA41-BDB6CF35E0C3@lassitu.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2007.01.20 17:52:32 +0100, Stefan Bethke wrote:
> Am 20.01.2007 um 13:24 schrieb Simon L. Nielsen:
>
> >BTW. with regard to the console.log file I really don't think it
> >should be put back inside the jail unless it's possible to make the
> >generation of the file entirely inside the jail since it's just not
> >worth the risk/complexity.
>
> I'm probably missing something, but why not replace:
> _jail_id=$(head -1 ${_tmp_jail})
> tail +2 ${_tmp_jail} >${_rootdir}/var/log/console.log
> with:
> _jail_id=$(head -1 ${_tmp_jail})
> tail +2 ${_tmp_jail} | jexec ${_jail_id} sh -c "cat >/var/log/
> console.log"
I thought of, and actually implemented, a similar solution when I
worked on the problem but there are two problems:
- You cannot be sure cat exists inside the jail.
- The jail could already have exited again in which case jexec will
fail.
--
Simon L. Nielsen
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070120170158.GC971>