From owner-freebsd-security@FreeBSD.ORG Tue May 10 23:18:52 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B6B68106564A for ; Tue, 10 May 2011 23:18:52 +0000 (UTC) (envelope-from jhellenthal@gmail.com) Received: from mail-iw0-f182.google.com (mail-iw0-f182.google.com [209.85.214.182]) by mx1.freebsd.org (Postfix) with ESMTP id 665948FC08 for ; Tue, 10 May 2011 23:18:51 +0000 (UTC) Received: by iwn33 with SMTP id 33so7985221iwn.13 for ; Tue, 10 May 2011 16:18:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:date:from:to:cc:subject:message-id :references:mime-version:content-type:content-disposition :in-reply-to:x-openpgp-key-id:x-openpgp-key-fingerprint :x-openpgp-key-url; bh=WLZvhKpcuSc4ViseEfBwGPMr/SycKTuBiCznZcu5gCw=; b=B6XB33gRjOogMQhaluIJR8ySz59upLJFb4FQiammufjisYGIV47c5Li7ziRoKHiDfM MoVUDYr29pt/L7lF0X8Puz2k5jjsf0262N4P8MxyU4ETLfEXfkD3dbVt4D/H1Cdc+pYA 2G9pPNPucQK3kgfqPhMZZxZUw8cSWFwL9BoX4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:x-openpgp-key-id :x-openpgp-key-fingerprint:x-openpgp-key-url; b=k3D/i4qYRI01ChRlcIEjcgpRJWlWAJXNa3/mqKOMc/xiiI3OEYGhJV6HgNpmeY9Y79 loWU4dOEawaSs/OQz5kuxQMzcHj74vlG3ZxS25kuTdNomi8b+x5gKScnFSnIqmB6U7zc opF+0uR52oeWa3cgnwa+pxls3o7+pxVh5OLrU= Received: by 10.42.66.147 with SMTP id p19mr2357024ici.7.1305069531704; Tue, 10 May 2011 16:18:51 -0700 (PDT) Received: from DataIX.net (adsl-99-190-84-116.dsl.klmzmi.sbcglobal.net [99.190.84.116]) by mx.google.com with ESMTPS id u17sm3272377ibm.28.2011.05.10.16.18.48 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 10 May 2011 16:18:49 -0700 (PDT) Sender: "J. Hellenthal" Received: from DataIX.net (localhost [127.0.0.1]) by DataIX.net (8.14.4/8.14.4) with ESMTP id p4ANIkgl055788 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 10 May 2011 19:18:46 -0400 (EDT) (envelope-from jhell@DataIX.net) Received: (from jhell@localhost) by DataIX.net (8.14.4/8.14.4/Submit) id p4ANIieS055787; Tue, 10 May 2011 19:18:44 -0400 (EDT) (envelope-from jhell@DataIX.net) Date: Tue, 10 May 2011 19:18:44 -0400 From: Jason Hellenthal To: Jamie Landeg Jones Message-ID: <20110510231843.GA67882@DataIX.net> References: <201105072231.p47MVktY035491@catflap.bishopston.net> <20110508075203.GA61754@DataIX.net> <20110508173931.GA2757@DataIX.net> <86fwoof8lj.fsf@ds4.des.no> <86zkmwdpdl.fsf@ds4.des.no> <20110509144947.GB77054@DataIX.net> <201105101218.p4ACIio8033823@catflap.bishopston.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="M9NhX3UHpAaciwkO" Content-Disposition: inline In-Reply-To: <201105101218.p4ACIio8033823@catflap.bishopston.net> X-OpenPGP-Key-Id: 0x89D8547E X-OpenPGP-Key-Fingerprint: 85EF E26B 07BB 3777 76BE B12A 9057 8789 89D8 547E X-OpenPGP-Key-URL: http://bit.ly/0x89D8547E Cc: des@des.no, feld@feld.me, edhoprima@gmail.com, utisoft@gmail.com, freebsd-security@freebsd.org Subject: Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 May 2011 23:18:52 -0000 --M9NhX3UHpAaciwkO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Jamie, On Tue, May 10, 2011 at 01:18:44PM +0100, Jamie Landeg Jones wrote: >=20 > > Do you know if there is a way that chmod on / from within the jail coul= d=20 > > be prevented easily without breaking something ? Maybe not failing but= =20 > > falling though and return 0 for any operation with the sole argument of= /. >=20 > Enforcing 700 on the jail root? >=20 > Whilst I was wrong on chmod 700 on (say) /usr/jails it is still the case > that the root directory of the jail itself (/usr/jail/jailname) has to > be 755 for non-root processeses within the jail to access the filesystem! >=20 Sorry for the late reply on this. What I was thinking of is enforcing from within the jail that all system=20 calls to chmod(2), chflags(2), chown(2) and anything that can change the=20 directories access modes should be passed silently when the argument to=20 the command is operating on the root directory. --=20 Regards, (jhell) Jason Hellenthal --M9NhX3UHpAaciwkO Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (FreeBSD) Comment: http://bit.ly/0x89D8547E iQEcBAEBAgAGBQJNycfTAAoJEJBXh4mJ2FR+0s4IAIXFxI7k819MBfSOAgvIxlgu HVXGlwGjB+EVDuPKiVGExlN0ezje+RUZWAkFfM/BGoTxAptY5Icz5bG4INHddyP5 ikoiqMSe68vEUKklmHQXs8tYI3Poj4u5ZpcuUcc3H4wL+QB+FQPtIAXXp4oEKHY0 3+0bMpQbFQ3QdeNVeA1sKdPId8uJYI4dT/tBVsrC1xJKlm3/nGmWZ+SCT6q7SEYI A+WImLiHa4l32E0mfEC7bbgmmg90Xg6Kg01stk3ZLBAHQzlcR8MMhnsGtQzJwztC NouVclKqxLIcSFFWvyDcymcYeVIdXgrUspEwXzzTj3sOVdxDvEd+lkQ50dN3y64= =upS1 -----END PGP SIGNATURE----- --M9NhX3UHpAaciwkO--