From owner-freebsd-bugs@FreeBSD.ORG  Wed Oct  8 15:30:18 2003
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AEE9A16A4B3
	for <freebsd-bugs@hub.freebsd.org>;
	Wed,  8 Oct 2003 15:30:18 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 33F1043FAF
	for <freebsd-bugs@hub.freebsd.org>;
	Wed,  8 Oct 2003 15:30:18 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h98MUHFY007597
	for <freebsd-bugs@freefall.freebsd.org>;
	Wed, 8 Oct 2003 15:30:17 -0700 (PDT)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h98MUH8Z007595;
	Wed, 8 Oct 2003 15:30:17 -0700 (PDT)
	(envelope-from gnats)
Date: Wed, 8 Oct 2003 15:30:17 -0700 (PDT)
Message-Id: <200310082230.h98MUH8Z007595@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Kris Kennaway <kris@obsecurity.org>
Subject: Re: kern/55568: DUMP has access to block devices in a JAIL
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Kris Kennaway <kris@obsecurity.org>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Oct 2003 22:30:18 -0000

The following reply was made to PR kern/55568; it has been noted by GNATS.

From: Kris Kennaway <kris@obsecurity.org>
To: mjoyner <mjoyner@rv1.dynip.com>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/55568: DUMP has access to block devices in a JAIL
Date: Wed, 8 Oct 2003 15:23:02 -0700

 --r5Pyd7+fXNt84Ff3
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 
 On Wed, Aug 13, 2003 at 09:04:06PM -0400, mjoyner wrote:
 
 >          A jailed root user can use DUMP and gain a snapshot of the
 > entire disk.
 >          From there the jailed root user can restore files from the HOST
 > SYSTEM
 >          or any other jails at their leisure.
 
 Only if the administrator has configured the jail with the raw disk
 devices.  As you note, this is a security risk.
 
 >          Even if DEVFS is not mounted, a root user could possibly create a
 >          device node anyways, and one needs TTYS anyways.
 
 I believe this to be untrue.  root cannot make device nodes once
 inside a jail.
 
 Kris
 --r5Pyd7+fXNt84Ff3
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.2.3 (FreeBSD)
 
 iD8DBQE/hI5GWry0BWjoQKURAhUDAJ9ur2Mx80oBoMLiVeureSPO0yn24gCfTAg5
 dpRlB3rsH/h95CnJTrJ8xVw=
 =2bQ5
 -----END PGP SIGNATURE-----
 
 --r5Pyd7+fXNt84Ff3--