Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur)

Jason Hellenthal <jhell@xxxxxxxxxx> writes:
Chris Rees <utisoft@xxxxxxxxx> writes:
I've updated the docs patches (links at [1]), though unfortunately it
means it's a little less elegant; I'm reluctant to suggest

# chmod 0700 $D/..
Haha I would strongly suggest against that ;) Not knowing where people are
keeping the jails would impose quite a bit of harm if they did have them
in places like that or /var/jailname.

What do you mean, "not knowing where people are keeping the jails"?
Only root can start a jail, so there is no risk of anyone starting a
hidden jail somewhere. Besides, jls(8) lists the root path of each
jail.

DES
--
Dag-Erling Smørgrav - des@xxxxxx
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Disk quota for Jail. Discussion.
    ... thus receiving current use of a disk. ... UFS cannot determine whether the new allocation goes under the jail ... But jail cannot allocate block and inode above root path. ...
    (freebsd-hackers)
  • Re: Rooting FreeBSD , Privilege Escalation using Jails (P??????tur)
    ... # chmod 0700 $D/.. ... hidden jail somewhere. ... jlslists the root path of each ... because we (the docs writers) don't know what the user ...
    (FreeBSD-Security)
  • Re: Disk quota for Jail. Discussion.
    ... thus receiving current use of a disk. ... UFS cannot determine whether the new allocation goes under the jail ... But jail cannot allocate block and inode above root path. ...
    (freebsd-hackers)
  • Re: Disk quota for Jail. Discussion.
    ... At start Jail, we calculate the size root path and number of files in it, thus receiving current use of a disk. ... In functions of allocation of disk blocks and inode, we check quotas and we increase current use. ...
    (freebsd-hackers)
  • Re: Disk quota for Jail. Discussion.
    ... Users which use jail, use separate zfs or md device for jail, but it from a hopelessness. ... I suggest to make disk quotas for jail on the basis of the user quotas. ... At start Jail, we calculate the size root path and number of files in it, thus receiving current use of a disk. ... In functions of allocation of disk blocks and inode, we check quotas and we increase current use. ...
    (freebsd-hackers)