Date: Sun, 21 Sep 2008 16:06:33 -0700 From: "Jason C. Wells" <jcw@highperformance.net> Cc: freebsd-stable <freebsd-stable@freebsd.org> Subject: Install -S Not Safe was: Re: Installworld deletes libc Message-ID: <48D6D379.10909@highperformance.net> In-Reply-To: <48D6CAAE.9060303@highperformance.net> References: <48D68FD6.50804@highperformance.net> <20080921215113.GB9494@icarus.home.lan> <48D6C995.7060606@highperformance.net> <48D6CAAE.9060303@highperformance.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Jason C. Wells wrote: > Jason C. Wells wrote: > I should add that 'systcl security.jail.chflags_allowed=1' allowed > installworld to proceed without error. That solves my immediate problem. > There appears to be a bug in the security mechanism. The reason there appeared to be a bug in the security mechanism is that I performed (IIRC) chflags -noschg on libc as root on the host system outside the jail. But for some reason 'install -S' was not safe. (outside the jail) ~$ chflags noschg /usr/jails/cr/lib/libc.so.6 (inside the jail) [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 -rwxr-xr-x 1 root wheel - 981331 Sep 21 15:57 /lib/libc.so.6 [root@s4cr /usr/src/lib/libc]# sysctl -a | grep secur kern.securelevel: -1 security.jail.chflags_allowed: 0 [root@s4cr /usr/src/lib/libc]# make install install -C -o root -g wheel -m 444 libc.a /usr/lib install -C -o root -g wheel -m 444 libc_p.a /usr/lib install -s -o root -g wheel -m 444 -fschg -S libc.so.6 /lib install: /lib/libc.so.6: chflags: Operation not permitted *** Error code 71 Stop in /usr/src/lib/libc. [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 /libexec/ld-elf.so.1: Shared object "libc.so.6" not found, required by "ls" [root@s4cr /usr/src/lib/libc]# Regards, Jason
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48D6D379.10909>