From owner-freebsd-bugs@FreeBSD.ORG Mon Sep 22 03:00:13 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 78CC41065675 for ; Mon, 22 Sep 2008 03:00:13 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 4CEEF8FC1B for ; Mon, 22 Sep 2008 03:00:13 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m8M30D2x040360 for ; Mon, 22 Sep 2008 03:00:13 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m8M30Dcx040359; Mon, 22 Sep 2008 03:00:13 GMT (envelope-from gnats) Resent-Date: Mon, 22 Sep 2008 03:00:13 GMT Resent-Message-Id: <200809220300.m8M30Dcx040359@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Jason C. Wells" Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1EC9C106564A for ; Mon, 22 Sep 2008 02:51:57 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 0AEEF8FC08 for ; Mon, 22 Sep 2008 02:51:57 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id m8M2puNG077883 for ; Mon, 22 Sep 2008 02:51:56 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id m8M2pu8Y077882; Mon, 22 Sep 2008 02:51:56 GMT (envelope-from nobody) Message-Id: <200809220251.m8M2pu8Y077882@www.freebsd.org> Date: Mon, 22 Sep 2008 02:51:56 GMT From: "Jason C. Wells" To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: misc/127532: Install -S Not Safe in Jail with security.jail.chflags_allowed: 0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Sep 2008 03:00:13 -0000 >Number: 127532 >Category: misc >Synopsis: Install -S Not Safe in Jail with security.jail.chflags_allowed: 0 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 22 03:00:12 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Jason C. Wells >Release: 6.2-RELEASE >Organization: >Environment: FreeBSD s4.stradamotorsports.com 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Thu Jan 11 13:05:44 PST 2007 jcw@w17.stradamotorsports.com:/usr/obj/usr/src/sys/S4 i386 >Description: The install command deleted libc when it should not have. Running the install command with '-fschg -S' deletes the install target when security.jail.chflags_allowed=0 inside a jail. I observed this during installworld. The problem can be avoided by setting security.jail.chflags_allowed=1 before running make installworld. >How-To-Repeat: (outside the jail) ~$ chflags noschg /usr/jails/cr/lib/libc.so.6 (inside the jail) [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 -rwxr-xr-x 1 root wheel - 981331 Sep 21 15:57 /lib/libc.so.6 [root@s4cr /usr/src/lib/libc]# sysctl -a | grep secur kern.securelevel: -1 security.jail.chflags_allowed: 0 [root@s4cr /usr/src/lib/libc]# make install install -C -o root -g wheel -m 444 libc.a /usr/lib install -C -o root -g wheel -m 444 libc_p.a /usr/lib install -s -o root -g wheel -m 444 -fschg -S libc.so.6 /lib install: /lib/libc.so.6: chflags: Operation not permitted *** Error code 71 Stop in /usr/src/lib/libc. [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 /libexec/ld-elf.so.1: Shared object "libc.so.6" not found, required by "ls" [root@s4cr /usr/src/lib/libc]# >Fix: >Release-Note: >Audit-Trail: >Unformatted: