From owner-freebsd-bugs@FreeBSD.ORG Mon Feb 25 15:30:03 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D21A816A404 for ; Mon, 25 Feb 2008 15:30:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id C997C13C461 for ; Mon, 25 Feb 2008 15:30:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m1PFU3V6060221 for ; Mon, 25 Feb 2008 15:30:03 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m1PFU3oR060218; Mon, 25 Feb 2008 15:30:03 GMT (envelope-from gnats) Date: Mon, 25 Feb 2008 15:30:03 GMT Message-Id: <200802251530.m1PFU3oR060218@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Ed Schouten Cc: Subject: Re: kern/121073: Patch to run chroot as an unprivileged user X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Ed Schouten List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Feb 2008 15:30:03 -0000 The following reply was made to PR kern/121073; it has been noted by GNATS. From: Ed Schouten To: bug-followup@FreeBSD.org, jille@quis.cx Cc: Subject: Re: kern/121073: Patch to run chroot as an unprivileged user Date: Mon, 25 Feb 2008 16:21:46 +0100 --P+33d92oIH25kiaB Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hello, Just wanted to add some info about what this patch does: As far as I know, the only unsafe thing about chroot(2) is the fact that you can trick set[ug]id applications to do unwanted things when hardlinked into a new root directory, for example: - The user could store a different C library inside the chroot to perform an execl("/bin/sh", ...). - The user could just store his own passwd files, including database files, to make applications like su(8) work, without the proper privileges. This patch adds a new flag called P_NOSUGID. When enabled, this process will not honor the setuid and setgid flags anymore, just like MNT_NOSUID and P_TRACED. I have great confidence that this patch does not add any security holes, but just to be sure, this patch adds a sysctl to disable this behaviour by default. --=20 Ed Schouten WWW: http://g-rave.nl/ --P+33d92oIH25kiaB Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (FreeBSD) iEYEARECAAYFAkfC3QoACgkQ52SDGA2eCwUDeQCfSYgrLLapQGsNZOfAZXU7jNqR 7c0AnREYpYIa4OojqVR7GoO8mT9MRrsi =Jir3 -----END PGP SIGNATURE----- --P+33d92oIH25kiaB--