From owner-freebsd-security@FreeBSD.ORG Mon May 9 11:04:20 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B664106564A for ; Mon, 9 May 2011 11:04:20 +0000 (UTC) (envelope-from utisoft@gmail.com) Received: from mail-bw0-f54.google.com (mail-bw0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id 7EBD88FC14 for ; Mon, 9 May 2011 11:04:19 +0000 (UTC) Received: by bwz12 with SMTP id 12so5749644bwz.13 for ; Mon, 09 May 2011 04:04:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=71HnWk++nHnRr4f8xVNivZobX+hN0zYFpF7ljIZP99E=; b=NpSNxXUoqCTkTwu3JZGOM32PfVo7xSual+lNyyfUJ1dGkc0g4aSo8/9QUNBBRJ1xra Giy72Bycefcma/NaRa69uh0fR3Zguf6IBeTNVdtIoilcfSwUc606rUlB0T9OVhSkYJYV WYhOoodZV3wyZIAY8K2Hg5pWpP4zUmSANIkKA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; b=pr/9dNRgmCxBe02UGUayVnLFliS1A3f5ezYZD8pVOK6VN5pwcMj3OWn4Y5sY9URKqO h3cFUXE15vE9pmg0qhpuRD6jPodqYx3UdAknU81geIKcoRSqowwbl4h/ii+ziiG347Ok SyyylQmGpUyXC3GpI9Ewn14jhi3BZP7a/oroI= Received: by 10.204.41.16 with SMTP id m16mr3009041bke.151.1304939058094; Mon, 09 May 2011 04:04:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.204.42.21 with HTTP; Mon, 9 May 2011 04:03:48 -0700 (PDT) In-Reply-To: <86fwoof8lj.fsf@ds4.des.no> References: <4DC40E21.6040503@gmail.com> <4DC4102E.8000700@gmail.com> <201105072231.p47MVktY035491@catflap.bishopston.net> <20110508075203.GA61754@DataIX.net> <20110508173931.GA2757@DataIX.net> <86fwoof8lj.fsf@ds4.des.no> From: Chris Rees Date: Mon, 9 May 2011 12:03:48 +0100 Message-ID: To: =?ISO-8859-1?Q?Dag=2DErling_Sm=F8rgrav?= Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: Jamie Landeg Jones , feld@feld.me, Edho P Arief , freebsd-security@freebsd.org Subject: Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: utisoft@gmail.com List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 May 2011 11:04:20 -0000 2011/5/9 Dag-Erling Sm=F8rgrav : > Jason Hellenthal writes: >> Chris Rees writes: >> > I've updated the docs patches (links at [1]), though unfortunately it >> > means it's a little less elegant; I'm reluctant to suggest >> > >> > # chmod 0700 $D/.. >> Haha I would strongly suggest against that ;) Not knowing where people a= re >> keeping the jails would impose quite a bit of harm if they did have them >> in places like that or /var/jailname. > > What do you mean, "not knowing where people are keeping the jails"? > Only root can start a jail, so there is no risk of anyone starting a > hidden jail somewhere. =A0Besides, jls(8) lists the root path of each > jail. >From a docs point of view, if I were to type: # setenv D /usr/local/myjail and then: # chmod 0700 $D/.. then I'd end up chmod'ing 700 /usr/local This is the point I'm making, I can't recommend in the docs that one chmods $D/.. because we (the docs writers) don't know what the user (the reader) is going to set $D to. Chris