Date: Sat, 20 Jan 2007 15:24:23 +0100 From: Alexander Leidinger <Alexander@Leidinger.net> To: Pawel Jakub Dawidek <pjd@FreeBSD.org> Cc: freebsd-security@freebsd.org, freebsd-stable@freebsd.org, Colin Percival <cperciva@freebsd.org>, "Simon L. Nielsen" <simon@FreeBSD.org> Subject: Re: Improving FreeBSD-SA-07:01.jail fix [was: HEADS UP: Re: FreeBSD Security Advisory FreeBSD-SA-07:01.jail] Message-ID: <20070120152423.3195b15b@Magellan.Leidinger.net> In-Reply-To: <20070120130308.GD6697@garage.freebsd.pl> References: <200701111841.l0BIfWOn015231@freefall.freebsd.org> <45A6DB76.40800@freebsd.org> <20070113112937.GI90718@garage.freebsd.pl> <20070120122432.GA971@zaphod.nitro.dk> <20070120130308.GD6697@garage.freebsd.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
Quoting Pawel Jakub Dawidek <pjd@FreeBSD.org> (Sat, 20 Jan 2007 14:03:08 +0100):
> I fully agree that console.log should be outside a jail. At least noone
> proposed safe solution so far, which also means it's not an easy fix.
What's unsafe about my proposal? I did had a look at the code now, and
it should work (with minor mods).
Original:
---snip---
_tmp_jail=${_tmp_dir}/jail.$$
eval jail ${_flags} -i ${_rootdir} ${_hostname} \
${_ip} ${_exec_start} > ${_tmp_jail} 2>&1
if [ "$?" -eq 0 ] ; then
_jail_id=$(head -1 ${_tmp_jail})
i=1
while [ true ]; do
eval out=\"\${_exec_afterstart${i}:-''}\"
if [ -z "$out" ]; then
break;
fi
jexec "${_jail_id}" ${out}
i=$((i + 1))
done
echo -n " $_hostname"
tail +2 ${_tmp_jail} >${_consolelog}
echo ${_jail_id} > /var/run/jail_${_jail}.id
---snip---
Pseudocode proposal, not tested (changes prefixed with 'x'):
---snip---
_tmp_jail=${_tmp_dir}/jail.$$
x # assuming safe _consolelog (inside chroot) according
to the
x # previous mails here in the thread
x eval (echo "" ; \
x jail ${_flags} -I /var/run/jail_${_jail}.id \
x ${_rootdir} ${_hostname} {_ip} ${_exec_start}) \
x > ${_consolelog} 2>&1
if [ "$?" -eq 0 ] ; then
x _jail_id=$(cat /var/run/jail_${_jail}.id)
i=1
while [ true ]; do
eval out=\"\${_exec_afterstart${i}:-''}\"
if [ -z "$out" ]; then
break;
fi
jexec "${_jail_id}" ${out}
i=$((i + 1))
done
echo -n " $_hostname"
x
x
---snip---
Repeating my points:
- sanitize the consolelog path like discussed in this thread
- the jail is not running, so nobody can create a link (jail
root within FS space of another jail still prohibited)
- subshell to group echo and jail
- 'echo ""' to make sure the file exists when the jail starts
- (new) additional flag to jail to write a jid file
- redirect to the consolelog, it is still open from the echo
when the jail starts so there's no race
I did test "(echo 1; sleep 60 ; echo 2) >/tmp/test" in /bin/sh, and it
is line buffered, so the above works.
Where's the security problem in the above?
Bye,
Alexander.
--
I wore my extra loose pants for nothing. Nothing!
-- Homer Simpson
New Kid on the Block
http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID = B0063FE7
http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID = 72077137
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070120152423.3195b15b>