From owner-freebsd-bugs@FreeBSD.ORG Sun Nov 21 23:20:10 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E8C161065679 for ; Sun, 21 Nov 2010 23:20:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id BD3AF8FC2B for ; Sun, 21 Nov 2010 23:20:09 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id oALNK9Dj082825 for ; Sun, 21 Nov 2010 23:20:09 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id oALNK9FC082824; Sun, 21 Nov 2010 23:20:09 GMT (envelope-from gnats) Resent-Date: Sun, 21 Nov 2010 23:20:09 GMT Resent-Message-Id: <201011212320.oALNK9FC082824@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Andrey Zholos Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 455D11065672 for ; Sun, 21 Nov 2010 23:17:37 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (unknown [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 340F98FC1B for ; Sun, 21 Nov 2010 23:17:37 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id oALNHa9N007707 for ; Sun, 21 Nov 2010 23:17:36 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id oALNHadV007706; Sun, 21 Nov 2010 23:17:36 GMT (envelope-from nobody) Message-Id: <201011212317.oALNHadV007706@red.freebsd.org> Date: Sun, 21 Nov 2010 23:17:36 GMT From: Andrey Zholos To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: conf/152465: [jail] devfs is mounted in jails without rules if devfs.rules can't be parsed X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Nov 2010 23:20:10 -0000 >Number: 152465 >Category: conf >Synopsis: [jail] devfs is mounted in jails without rules if devfs.rules can't be parsed >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Nov 21 23:20:09 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Andrey Zholos >Release: 9.0-CURRENT >Organization: >Environment: FreeBSD freebsd 9.0-CURRENT-201011 FreeBSD 9.0-CURRENT-201011 #0: Wed Nov 3 18:19:06 UTC 2010 root@obrian.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: If /etc/devfs.rules contains invalid rules and can't be parsed, devfs is still mounted inside jails, exposing all host devices to a potentially untrusted environment. Because parsing of rules stops at the first error, this can happen when the invalid rule is in a group of rules unrelated to the jail, and even when a syntactically-correct rule becomes invalid. For example, the rule add path 'ulpt*' mode 0660 group cups becomes invalid when CUPS is deinstalled (removing the cups group). This produces a warning, but jails are already started with full access to devfs before the rule can be removed. This doesn't affect jails using the standard ruleset (devfsrules_jail in /etc/defaults/devfs.rules), only those using a custom ruleset in /etc/devfs.rules which is specified after an invalid rule. >How-To-Repeat: Make a simple jail (replace "ad0"): # mkdir -p /sandbox/{dev,etc,bin,lib,libexec} # cp /bin/dd /sandbox/bin # cp /lib/libc.so.* /sandbox/lib # cp /libexec/ld-elf.so.* /sandbox/libexec # echo 'root:*:0:0::0:0:Root:/:' > /sandbox/etc/master.passwd # pwd_mkdb -p -d /sandbox/etc /sandbox/etc/master.passwd /etc/rc.conf has: jail_enable="YES" jail_list="sandbox" jail_sandbox_hostname="sandbox" jail_sandbox_rootdir="/sandbox" jail_sandbox_devfs_enable="YES" jail_sandbox_devfs_ruleset="sandbox_rules" jail_sandbox_exec_start="/bin/dd if=/dev/ad0 of=ad0_copy count=1" /etc/devfs.rules has: [sandbox_rules=100] add hide Normal start, jail can't access host disk: # /etc/rc.d/jail start Configuring jails:. Starting jails: cannot start jail "sandbox": dd: /dev/ad0: No such file or directory >Fix: >Release-Note: >Audit-Trail: >Unformatted: