From owner-freebsd-security@FreeBSD.ORG  Thu Dec 29 19:00:44 2011
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E67941065676;
	Thu, 29 Dec 2011 19:00:44 +0000 (UTC) (envelope-from jhb@freebsd.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id BA9778FC18;
	Thu, 29 Dec 2011 19:00:44 +0000 (UTC)
Received: from bigwig.baldwin.cx (bigwig.baldwin.cx [96.47.65.170])
	by cyrus.watson.org (Postfix) with ESMTPSA id 712CE46B09;
	Thu, 29 Dec 2011 14:00:44 -0500 (EST)
Received: from jhbbsd.localnet (unknown [209.249.190.124])
	by bigwig.baldwin.cx (Postfix) with ESMTPSA id D8C10B96B;
	Thu, 29 Dec 2011 14:00:43 -0500 (EST)
From: John Baldwin <jhb@freebsd.org>
To: d@delphij.net
Date: Thu, 29 Dec 2011 14:00:41 -0500
User-Agent: KMail/1.13.5 (FreeBSD/8.2-CBSD-20110714-p8; KDE/4.5.5; amd64; ; )
References: <201112231500.pBNF0c0O071712@svn.freebsd.org>
	<201112291343.02248.jhb@freebsd.org> <4EFCB4F1.2050500@delphij.net>
In-Reply-To: <4EFCB4F1.2050500@delphij.net>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201112291400.41075.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7
	(bigwig.baldwin.cx); Thu, 29 Dec 2011 14:00:44 -0500 (EST)
Cc: freebsd-security@freebsd.org, Doug Barton <dougb@freebsd.org>
Subject: Re: svn commit: r228843 - head/contrib/telnet/libtelnet
	head/crypto/heimdal/appl/telnet/libtelnet head/include
	head/lib/libc/gen head/lib/libc/iconv head/lib/libc/include
	head/lib/libc/net head/libexec...
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Dec 2011 19:00:45 -0000

On Thursday, December 29, 2011 1:44:01 pm Xin Li wrote:
> On 12/29/11 10:43, John Baldwin wrote:
> > On Thursday, December 29, 2011 1:26:17 pm Xin Li wrote:
> >> On 12/29/11 06:39, John Baldwin wrote:
> >>> Can you give some more details on why ftpd is triggering a
> >>> dlopen inside of the chroot?  It would appear that that is
> >>> unrelated to helper programs (since setting a flag in libc in
> >>> ftpd can't possibly affect helper programs ability to use
> >>> dlopen() from within libc).
> >>
> >> Sure.  That's because nsdispatch(3) would reload
> >> /etc/nsswitch.conf if it notices a change.  After chroot() the
> >> file is considered as "chang"ed and thus it reloads the file as
> >> well as designated shared libraries.
> >
> > But ftpd has to be doing some operation that invokes an nss lookup
> > after entering the chroot for that to trigger, correct?
> 
> Oh ok, that was the built-in ls(1).

Were we not able to drop privilege before doing that?  I.e. if you
forked a new process that dropped privilege before doing the ls
(similar to if you were to exec /bin/ls as a helper), would that not
have fixed this?

-- 
John Baldwin