From owner-freebsd-jail@FreeBSD.ORG  Thu May 14 19:12:48 2009
Return-Path: <owner-freebsd-jail@FreeBSD.ORG>
Delivered-To: jail@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 5FFCE1065672;
	Thu, 14 May 2009 19:12:48 +0000 (UTC)
	(envelope-from jamie@FreeBSD.org)
Received: from gritton.org (gritton.org [161.58.222.4])
	by mx1.freebsd.org (Postfix) with ESMTP id 26E178FC0A;
	Thu, 14 May 2009 19:12:47 +0000 (UTC)
	(envelope-from jamie@FreeBSD.org)
Received: from guppy.corp.verio.net (fw.oremut02.us.wh.verio.net
	[198.65.168.24]) (authenticated bits=0)
	by gritton.org (8.13.6.20060614/8.13.6) with ESMTP id n4EJCk60054688;
	Thu, 14 May 2009 13:12:46 -0600 (MDT)
Message-ID: <4A0C6D29.7020606@FreeBSD.org>
Date: Thu, 14 May 2009 13:12:41 -0600
From: Jamie Gritton <jamie@FreeBSD.org>
User-Agent: Thunderbird 2.0.0.19 (X11/20090109)
MIME-Version: 1.0
To: Jilles Tjoelker <jilles@stack.nl>
References: <4A051DE3.30705@FreeBSD.org> <4A0C5112.9010103@FreeBSD.org>
	<20090514181446.GA42264@stack.nl>
In-Reply-To: <20090514181446.GA42264@stack.nl>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV 0.94.2/9358/Thu May 14 08:48:24 2009 on gritton.org
X-Virus-Status: Clean
Cc: virtualization@FreeBSD.org, jail@FreeBSD.org,
	FreeBSD Current <freebsd-current@FreeBSD.org>
Subject: Re: Hierarchical jails
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
	<mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
	<mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 14 May 2009 19:12:48 -0000

Jilles Tjoelker wrote:
> On Thu, May 14, 2009 at 11:12:50AM -0600, Jamie Gritton wrote:
>> There's still a change to offer your input on the new jails before they
>> go in!  OK, given the lack of response so far, it's less "still a
>> chance" than "please?".  Current plans are to have this in place for
>> 8.0, with connections to the ongoing Vimage work.  Hopefully the silence
>> is approval, and commits will likely be appearing soon.
> 
> I have not tried this, but I think this patch may allow jailed roots to
> escape. The problem is that there is only one fd_jdir. The escape would
> go like: jailed root creates a new jail in a subdirectory, opens its /
> and sends the fd to a process in the new jail via a unix domain socket.
> When the process calls fchdir on the fd, it will be able to access ..
> normally.
> 
> With nested chroot, or chroot in jail, this is not possible, because
> fd_jdir always contains the first jail or chroot done and will not allow
> escaping from it; however, root in a level 2 chroot can escape back to
> level 1 using chroot.


Indeed - considering how that was a major design point of jails, I'm not
sure how I missed it.  ".." processing will need to run up the jail
tree.  No big deal on performance and easily done, but embarrassing not
have had that in place already.