From owner-freebsd-security Thu Dec 17 23:52:43 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id XAA03842 for freebsd-security-outgoing; Thu, 17 Dec 1998 23:52:43 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from fep04-svc.tin.it (mta04-acc.tin.it [212.216.176.35]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id XAA03833 for ; Thu, 17 Dec 1998 23:52:33 -0800 (PST) (envelope-from molter@tin.it) Received: from nympha.ecomotor.it ([212.216.1.207]) by fep04-svc.tin.it (InterMail v4.0 201-221-105) with SMTP id <19981218075211.BIYR23050.fep04-svc@nympha.ecomotor.it> for ; Fri, 18 Dec 1998 08:52:11 +0100 Received: (qmail 481 invoked by uid 1000); 18 Dec 1998 07:51:38 -0000 From: "Marco Molteni" Date: Fri, 18 Dec 1998 08:51:38 +0100 (CET) X-Sender: molter@nympha To: freebsd-security@FreeBSD.ORG Subject: buffer overflows and chroot Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi all, I am administering 3 FreeBSD machines at a lab at my University (yes, they are the *first* FreeBSD machines in my university :-) We are working on IPv6/IPsec with the nice KAME kit (hello Itojun). Yesterday came a guy, working on a "automatic buffer overflow exploiting program". I had to give him an account on my beloved machines, since my professor told me so. The situation is: I trust enough this guy not to do evil things, but his target is to get root via buffer overflow. He needs a compiler and some suid executables to test his tool. My question is: can I restrict him in a sort of sandbox? If I build a chroot environment with the tools he needs (compiler and bins) I can give him some suid executables, where the owner isn't root. Is it right? Marco (who started to sweat) --- "Hi, I have a Compaq machine running Windows 95. How do I install FreeBSD?" "I'm sorry, this is device driver testing: brain implants are two doors down on the right". (Bill Paul, on the freebsd-net mailing list) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message