Date: Mon, 9 May 2011 12:03:48 +0100 From: Chris Rees <utisoft@gmail.com> To: =?ISO-8859-1?Q?Dag=2DErling_Sm=F8rgrav?= <des@des.no> Cc: Jamie Landeg Jones <jamie@bishopston.net>, feld@feld.me, Edho P Arief <edhoprima@gmail.com>, freebsd-security@freebsd.org Subject: Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur) Message-ID: <BANLkTi=-0=L0MmezOCa=tiv6DrwHYZ83AQ@mail.gmail.com> In-Reply-To: <86fwoof8lj.fsf@ds4.des.no> References: <4DC40E21.6040503@gmail.com> <4DC4102E.8000700@gmail.com> <op.vu2g4b0k34t2sn@tech304> <BANLkTikJgPt4SM_B_7drpgFvO8RkvXaOtw@mail.gmail.com> <201105072231.p47MVktY035491@catflap.bishopston.net> <BANLkTikgnqXB4pdvCd9j9n7pFvg=n5FrdQ@mail.gmail.com> <20110508075203.GA61754@DataIX.net> <BANLkTi=8by=rtbNUDtA8CRSMJsmgPOR2XA@mail.gmail.com> <20110508173931.GA2757@DataIX.net> <86fwoof8lj.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
2011/5/9 Dag-Erling Sm=F8rgrav <des@des.no>: > Jason Hellenthal <jhell@DataIX.net> writes: >> Chris Rees <utisoft@gmail.com> writes: >> > I've updated the docs patches (links at [1]), though unfortunately it >> > means it's a little less elegant; I'm reluctant to suggest >> > >> > # chmod 0700 $D/.. >> Haha I would strongly suggest against that ;) Not knowing where people a= re >> keeping the jails would impose quite a bit of harm if they did have them >> in places like that or /var/jailname. > > What do you mean, "not knowing where people are keeping the jails"? > Only root can start a jail, so there is no risk of anyone starting a > hidden jail somewhere. =A0Besides, jls(8) lists the root path of each > jail. >From a docs point of view, if I were to type: # setenv D /usr/local/myjail and then: # chmod 0700 $D/.. then I'd end up chmod'ing 700 /usr/local This is the point I'm making, I can't recommend in the docs that one chmods $D/.. because we (the docs writers) don't know what the user (the reader) is going to set $D to. Chris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BANLkTi=-0=L0MmezOCa=tiv6DrwHYZ83AQ>