Date: Tue, 10 May 2011 20:24:57 +0100 From: Jamie Landeg Jones <jamie@bishopston.net> To: jilles@stack.nl, jamie@bishopston.net Cc: jhell@DataIX.net, db@db.net, freebsd-security@freebsd.org Subject: Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur) Message-ID: <201105101924.p4AJOvJV004739@catflap.bishopston.net> In-Reply-To: <20110510190956.GA43634@stack.nl> References: <4DC40E21.6040503@gmail.com> <4DC4102E.8000700@gmail.com> <op.vu2g4b0k34t2sn@tech304> <BANLkTikJgPt4SM_B_7drpgFvO8RkvXaOtw@mail.gmail.com> <201105072231.p47MVktY035491@catflap.bishopston.net> <BANLkTikgnqXB4pdvCd9j9n7pFvg=n5FrdQ@mail.gmail.com> <201105091155.p49Bt604053259@catflap.bishopston.net> <20110510011249.GE2558@DataIX.net> <20110510145952.GA18253@night.db.net> <201105101508.p4AF8u8T069950@catflap.bishopston.net> <20110510190956.GA43634@stack.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
> It is still required for .. to work. > > For example, if the /usr directory on / is 700 but the directory on the > mounted filesystem is 755, everyone can use pathnames under /usr but only > root can use /usr/.. which is confusing and undesirable. > > > I always make mount-points 0111 these days > > I'd recommend to keep doing that :) Wow! Good catch! I missed that! And I note that ".." doesn't even appear on an ls -a That tells you too, Chris Rees :-) Ok, I'll stick with 0111 - also, the reason I use 0111 instead of just the default 755 (or whatever) is that it's an alert to me if some mount isn't mounted for whatever reason. To me, 0111 means mount-point only, period. Cheers, Jamie
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201105101924.p4AJOvJV004739>