Re: Escaping from a jail with root privileges on the host
Stephen Montgomery-Smith <stephen@missouri.edu> writes:
> I agree with the poster that the jail didn't really escape, but was
> "sprung from the outside."
Easily prevented by making sure that every jail's root directory is
unreachable to unprivileged users. Say your jails are in /jail/foo,
/jail/bar and /jail/baz; if /jail is readable only by root (and perhaps
wheel), it won't be possible for anyone else to move a directory out of
a jail.
> But more than that, I imagine it would be very hard to stop this
> without either completely rethinking how unix filesystems work, or
> adding significant overhead to the OS so that it checks every single
> "mv" command against all existing jails.
Not really. It is trivial to get a list of processes that have a given
vnode as their wd:
% fstat $PWD
USER CMD PID FD MOUNT INUM MODE SZ|DV R/W NAME
des fstat 80052 wd /home/des 3 drwxr-xr-x 398 r /hom=
e/des
des zsh 77329 wd /home/des 3 drwxr-xr-x 398 r /hom=
e/des
des zsh 26841 wd /home/des 3 drwxr-xr-x 398 r /hom=
e/des
des emacs 2577 wd /home/des 3 drwxr-xr-x 398 r /hom=
e/des
des zsh 2574 wd /home/des 3 drwxr-xr-x 398 r /hom=
e/des
So if any of these processes are jailed and the new location is outside
the jail root, the process should have its wd either forcibly changed
(e.g. to the jail root) or invalidated somehow.
The problem is that you not only have to check the directory you're
moving, but all its subdirectories as well. I can think of ways to
speed up the process; they require non-trivial changes to VFS, but not
"completely rethinking how unix filesystems work".
DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
討論串 (同標題文章)
完整討論串 (本文為第 8 之 8 篇)：