Date: Mon, 22 Sep 2008 02:51:56 GMT From: "Jason C. Wells" <jcw@highperformance.net> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/127532: Install -S Not Safe in Jail with security.jail.chflags_allowed: 0 Message-ID: <200809220251.m8M2pu8Y077882@www.freebsd.org> Resent-Message-ID: <200809220300.m8M30Dcx040359@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 127532 >Category: misc >Synopsis: Install -S Not Safe in Jail with security.jail.chflags_allowed: 0 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 22 03:00:12 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Jason C. Wells >Release: 6.2-RELEASE >Organization: >Environment: FreeBSD s4.stradamotorsports.com 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Thu Jan 11 13:05:44 PST 2007 jcw@w17.stradamotorsports.com:/usr/obj/usr/src/sys/S4 i386 >Description: The install command deleted libc when it should not have. Running the install command with '-fschg -S' deletes the install target when security.jail.chflags_allowed=0 inside a jail. I observed this during installworld. The problem can be avoided by setting security.jail.chflags_allowed=1 before running make installworld. >How-To-Repeat: (outside the jail) ~$ chflags noschg /usr/jails/cr/lib/libc.so.6 (inside the jail) [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 -rwxr-xr-x 1 root wheel - 981331 Sep 21 15:57 /lib/libc.so.6 [root@s4cr /usr/src/lib/libc]# sysctl -a | grep secur kern.securelevel: -1 security.jail.chflags_allowed: 0 [root@s4cr /usr/src/lib/libc]# make install install -C -o root -g wheel -m 444 libc.a /usr/lib install -C -o root -g wheel -m 444 libc_p.a /usr/lib install -s -o root -g wheel -m 444 -fschg -S libc.so.6 /lib install: /lib/libc.so.6: chflags: Operation not permitted *** Error code 71 Stop in /usr/src/lib/libc. [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 /libexec/ld-elf.so.1: Shared object "libc.so.6" not found, required by "ls" [root@s4cr /usr/src/lib/libc]# >Fix: >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200809220251.m8M2pu8Y077882>