From owner-freebsd-security@FreeBSD.ORG Sun May 8 08:58:36 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C8C061065672 for ; Sun, 8 May 2011 08:58:36 +0000 (UTC) (envelope-from utisoft@gmail.com) Received: from mail-bw0-f54.google.com (mail-bw0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id 4C41A8FC0A for ; Sun, 8 May 2011 08:58:35 +0000 (UTC) Received: by bwz12 with SMTP id 12so4983744bwz.13 for ; Sun, 08 May 2011 01:58:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=Nnv+fkUb5DenOuqlQ7J4Hu6q5jCVXBgxoxJF4gmvN/M=; b=DwyhVKjM6XT723FP2Z5+keAlcVgBfocXrOmX5qC3ldASXKY/NkuFyCVZ/S4txQTOBf Kx2BGlzZcdarNyHpBRyXWd2AX1mfggug9JAX/94sNgB8qU6jTdWVTC+EyKFGifZzbNju /PlyjuDh82fQ5mLtnabWJdJqAYusLvJ65k29g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; b=qqvwIDMC0MOcJz3jUu3XelT33RL0+Zw32wA8f30OER0oRieLdfYMzdUtUwwCAUIwaB TErWGpg3Cz8i4pX9jsEY3fqbeD2efRFnKMqmZmmmT9QjR9eLc+oK3VxwEu5Zgfm2gTt1 +iMq5CMZZkLw0QAO9BAHqpCyvqMSbHqm+yOkQ= Received: by 10.204.74.11 with SMTP id s11mr1269857bkj.43.1304845115115; Sun, 08 May 2011 01:58:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.204.42.21 with HTTP; Sun, 8 May 2011 01:58:05 -0700 (PDT) In-Reply-To: <20110508075203.GA61754@DataIX.net> References: <4DC40E21.6040503@gmail.com> <4DC4102E.8000700@gmail.com> <201105072231.p47MVktY035491@catflap.bishopston.net> <20110508075203.GA61754@DataIX.net> From: Chris Rees Date: Sun, 8 May 2011 09:58:05 +0100 Message-ID: To: Jason Hellenthal Content-Type: text/plain; charset=ISO-8859-1 Cc: Jamie Landeg Jones , freebsd-security@freebsd.org, feld@feld.me, Edho P Arief Subject: Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: utisoft@gmail.com List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 May 2011 08:58:36 -0000 On 8 May 2011 08:52, Jason Hellenthal wrote: > > Edho, > > On Sun, May 08, 2011 at 09:15:28AM +0700, Edho P Arief wrote: >> On Sun, May 8, 2011 at 5:31 AM, Jamie Landeg Jones wrote: >> >> All the same, I've sent a PR [1] with some doc patches to make people >> >> more aware of this -- fulfilling my promise of 2+ years ago :S >> >> >> >> Thanks! >> >> >> >> Chris >> >> >> >> [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=156853 >> > >> > Um. Some problems here. >> > >> > A jail won't work for not-root users if the jail root directory is chmod 700 - although >> > there is obviously a 'chroot' running withing the jail, the jailed user still needs >> > to have read permission from the hosts / -- chmod 700 therefore locks all non-root >> > users out. >> > >> >> It's weird - I don't remember having such problem after setting jails' >> root directory permission to 700. I don't have the system anymore so I >> can't verify it just yet. > > It should also be noted here that the jailed root user also has permission > to chmod(1) '/' to anything he or she wants unless you have taken > precaution to not allow that. I would reccoment storing your jails two > levels deep into a directory and chmod(1) 700 the first level to prevent > access from the host and from the jailed root user changing the perms. > Oops, you're absolutely right. I've updated the docs patches (links at [1]), though unfortunately it means it's a little less elegant; I'm reluctant to suggest # chmod 0700 $D/.. in case someone sets $D to /usr/local/myjail or similar... Chris [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=docs/156853