From owner-freebsd-stable@FreeBSD.ORG Mon Sep 22 00:14:00 2008 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BA88A1065670 for ; Mon, 22 Sep 2008 00:14:00 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from QMTA05.westchester.pa.mail.comcast.net (qmta05.westchester.pa.mail.comcast.net [76.96.62.48]) by mx1.freebsd.org (Postfix) with ESMTP id 611208FC14 for ; Mon, 22 Sep 2008 00:14:00 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from OMTA01.westchester.pa.mail.comcast.net ([76.96.62.11]) by QMTA05.westchester.pa.mail.comcast.net with comcast id HRYh1a00E0EZKEL55cDzw3; Mon, 22 Sep 2008 00:13:59 +0000 Received: from koitsu.dyndns.org ([67.180.253.227]) by OMTA01.westchester.pa.mail.comcast.net with comcast id HcDy1a00D4v8bD73McDzSw; Mon, 22 Sep 2008 00:13:59 +0000 X-Authority-Analysis: v=1.0 c=1 a=ZATkyH-5bjcA:10 a=6YigLTJI8gAA:10 a=QycZ5dHgAAAA:8 a=InRNKUORHqx8m2ldgBkA:9 a=EK9r6DdPXYp6CyuB8dEA:7 a=jGv_wYzgUXpCLeWW2f1Po1KHz-YA:4 a=EoioJ0NPDVgA:10 a=LY0hPdMaydYA:10 Received: by icarus.home.lan (Postfix, from userid 1000) id 5124417B81A; Sun, 21 Sep 2008 17:13:58 -0700 (PDT) Date: Sun, 21 Sep 2008 17:13:58 -0700 From: Jeremy Chadwick To: "Jason C. Wells" Message-ID: <20080922001358.GB12112@icarus.home.lan> References: <48D68FD6.50804@highperformance.net> <20080921215113.GB9494@icarus.home.lan> <48D6C995.7060606@highperformance.net> <48D6CAAE.9060303@highperformance.net> <48D6D379.10909@highperformance.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <48D6D379.10909@highperformance.net> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: freebsd-stable Subject: Re: Install -S Not Safe was: Re: Installworld deletes libc X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Sep 2008 00:14:00 -0000 On Sun, Sep 21, 2008 at 04:06:33PM -0700, Jason C. Wells wrote: > Jason C. Wells wrote: >> Jason C. Wells wrote: > >> I should add that 'systcl security.jail.chflags_allowed=1' allowed >> installworld to proceed without error. That solves my immediate >> problem. There appears to be a bug in the security mechanism. > > The reason there appeared to be a bug in the security mechanism is that > I performed (IIRC) chflags -noschg on libc as root on the host system > outside the jail. > > But for some reason 'install -S' was not safe. > > (outside the jail) > ~$ chflags noschg /usr/jails/cr/lib/libc.so.6 > > (inside the jail) > [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 > -rwxr-xr-x 1 root wheel - 981331 Sep 21 15:57 /lib/libc.so.6 > > [root@s4cr /usr/src/lib/libc]# sysctl -a | grep secur > kern.securelevel: -1 > security.jail.chflags_allowed: 0 > > [root@s4cr /usr/src/lib/libc]# make install > install -C -o root -g wheel -m 444 libc.a /usr/lib > install -C -o root -g wheel -m 444 libc_p.a /usr/lib > install -s -o root -g wheel -m 444 -fschg -S libc.so.6 /lib > install: /lib/libc.so.6: chflags: Operation not permitted > *** Error code 71 > > Stop in /usr/src/lib/libc. > > [root@s4cr /usr/src/lib/libc]# ls -lao /lib/libc.so.6 > /libexec/ld-elf.so.1: Shared object "libc.so.6" not found, required by "ls" > [root@s4cr /usr/src/lib/libc]# Please file a PR on this matter. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |