From owner-freebsd-jail@FreeBSD.ORG  Mon Jun  1 01:56:43 2009
Return-Path: <owner-freebsd-jail@FreeBSD.ORG>
Delivered-To: freebsd-jail@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 736991065674
	for <freebsd-jail@freebsd.org>; Mon,  1 Jun 2009 01:56:43 +0000 (UTC)
	(envelope-from lists.freebsd@gmail.com)
Received: from mail-fx0-f161.google.com (mail-fx0-f161.google.com
	[209.85.220.161])
	by mx1.freebsd.org (Postfix) with ESMTP id 044F48FC14
	for <freebsd-jail@freebsd.org>; Mon,  1 Jun 2009 01:56:42 +0000 (UTC)
	(envelope-from lists.freebsd@gmail.com)
Received: by fxm5 with SMTP id 5so95599fxm.19
	for <freebsd-jail@freebsd.org>; Sun, 31 May 2009 18:56:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:in-reply-to:references
	:date:message-id:subject:from:to:content-type
	:content-transfer-encoding;
	bh=DG4G2ivf0bs2WggtQRBJSka43bMjiZk1Pnas5WR2R/A=;
	b=xFJoqIFLv2YvjtW9GhblkOVBOuON0OnJsvfe9qhPddTExQiDQJU+vbjZMPaiEFCupo
	MPCbpOjaWIk7laJdlvQCI71pb5HnxjS6lyOrDe+4JJrEJW+OzKZxb4SffZ8tJtYUBrVI
	IGkNo4agrvOZ5tT3zvK+55YL+abaEJSLSB/DU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type:content-transfer-encoding;
	b=JUTvhHHMVr2xj2hhKqzc/S2T9mHeSmPH7iICYpIJn4wlohsMWXeVsmHaJzv0wsWuqY
	w5Nw6iL9TGAv2bXiWsi3KTJkYIbthLBADKIqDQzpEqAr2TGC+GHycOEvbdk1K9YY+QIz
	PAnxqSKLBRxSOZj3WThX6PkhKD5OCkwIrMUrE=
MIME-Version: 1.0
Received: by 10.204.102.15 with SMTP id e15mr5059155bko.196.1243821401919; 
	Sun, 31 May 2009 18:56:41 -0700 (PDT)
In-Reply-To: <5da021490905311447ya99c484ucaeabc74e813f394@mail.gmail.com>
References: <99c92b5f0905311149u4023d197s7302fae0b816d463@mail.gmail.com>
	<5da021490905311447ya99c484ucaeabc74e813f394@mail.gmail.com>
Date: Mon, 1 Jun 2009 03:56:41 +0200
Message-ID: <99c92b5f0905311856r4cb9e23apfd36b806b0250f45@mail.gmail.com>
From: Richard Noorlandt <lists.freebsd@gmail.com>
To: freebsd-jail@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: Implications of allow_raw_sockets=1
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
	<mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
	<mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Jun 2009 01:56:43 -0000

2009/5/31 Justin G. <justin@sigsegv.ca>:
> Raw sockets can allow processes to sniff onto the network, craft
> malformed packets, execute DDoS attacks, inject packets, among other
> things.

These are basically things that any non-virtualized server could do on the
network. As such, disallowing raw sockets should give higher security than a
'normal' server running FreeBSD without a jail.

But does the use of raw sockets open up holes that could allow the root user
in a jail to break in on another jail? I'm particularly concerned in attack
vectors that wouldn't exist with multiple real hosts connected through a dumb
switch (which usually introduces all the risks you mentioned).

Best regards,

Richard