From owner-freebsd-security@FreeBSD.ORG Sat Jan 20 14:24:41 2007 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id DCB8416A401; Sat, 20 Jan 2007 14:24:41 +0000 (UTC) (envelope-from alexander@leidinger.net) Received: from redbull.bpaserver.net (redbullneu.bpaserver.net [213.198.78.217]) by mx1.freebsd.org (Postfix) with ESMTP id 317F813C45D; Sat, 20 Jan 2007 14:24:41 +0000 (UTC) (envelope-from alexander@leidinger.net) Received: from outgoing.leidinger.net (p54A5DAA7.dip.t-dialin.net [84.165.218.167]) by redbull.bpaserver.net (Postfix) with ESMTP id B50E42E1AB; Sat, 20 Jan 2007 15:33:06 +0100 (CET) Received: from Magellan.Leidinger.net (Magellan.Leidinger.net [192.168.1.1]) by outgoing.leidinger.net (Postfix) with ESMTP id 9F4EF5B482A; Sat, 20 Jan 2007 15:24:23 +0100 (CET) Date: Sat, 20 Jan 2007 15:24:23 +0100 From: Alexander Leidinger To: Pawel Jakub Dawidek Message-ID: <20070120152423.3195b15b@Magellan.Leidinger.net> In-Reply-To: <20070120130308.GD6697@garage.freebsd.pl> References: <200701111841.l0BIfWOn015231@freefall.freebsd.org> <45A6DB76.40800@freebsd.org> <20070113112937.GI90718@garage.freebsd.pl> <20070120122432.GA971@zaphod.nitro.dk> <20070120130308.GD6697@garage.freebsd.pl> X-Mailer: Claws Mail 2.7.1 (GTK+ 2.10.8; i686-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BPAnet-MailScanner-Information: Please contact the ISP for more information X-BPAnet-MailScanner: Found to be clean X-BPAnet-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-14.864, required 6, autolearn=not spam, BAYES_00 -15.00, DK_POLICY_SIGNSOME 0.00, FORGED_RCVD_HELO 0.14) X-BPAnet-MailScanner-From: alexander@leidinger.net X-Spam-Status: No X-Mailman-Approved-At: Mon, 22 Jan 2007 05:05:17 +0000 Cc: freebsd-security@freebsd.org, freebsd-stable@freebsd.org, Colin Percival , "Simon L. Nielsen" Subject: Re: Improving FreeBSD-SA-07:01.jail fix [was: HEADS UP: Re: FreeBSD Security Advisory FreeBSD-SA-07:01.jail] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Jan 2007 14:24:41 -0000 Quoting Pawel Jakub Dawidek (Sat, 20 Jan 2007 14:03:08 +0100): > I fully agree that console.log should be outside a jail. At least noone > proposed safe solution so far, which also means it's not an easy fix. What's unsafe about my proposal? I did had a look at the code now, and it should work (with minor mods). Original: ---snip--- _tmp_jail=${_tmp_dir}/jail.$$ eval jail ${_flags} -i ${_rootdir} ${_hostname} \ ${_ip} ${_exec_start} > ${_tmp_jail} 2>&1 if [ "$?" -eq 0 ] ; then _jail_id=$(head -1 ${_tmp_jail}) i=1 while [ true ]; do eval out=\"\${_exec_afterstart${i}:-''}\" if [ -z "$out" ]; then break; fi jexec "${_jail_id}" ${out} i=$((i + 1)) done echo -n " $_hostname" tail +2 ${_tmp_jail} >${_consolelog} echo ${_jail_id} > /var/run/jail_${_jail}.id ---snip--- Pseudocode proposal, not tested (changes prefixed with 'x'): ---snip--- _tmp_jail=${_tmp_dir}/jail.$$ x # assuming safe _consolelog (inside chroot) according to the x # previous mails here in the thread x eval (echo "" ; \ x jail ${_flags} -I /var/run/jail_${_jail}.id \ x ${_rootdir} ${_hostname} {_ip} ${_exec_start}) \ x > ${_consolelog} 2>&1 if [ "$?" -eq 0 ] ; then x _jail_id=$(cat /var/run/jail_${_jail}.id) i=1 while [ true ]; do eval out=\"\${_exec_afterstart${i}:-''}\" if [ -z "$out" ]; then break; fi jexec "${_jail_id}" ${out} i=$((i + 1)) done echo -n " $_hostname" x x ---snip--- Repeating my points: - sanitize the consolelog path like discussed in this thread - the jail is not running, so nobody can create a link (jail root within FS space of another jail still prohibited) - subshell to group echo and jail - 'echo ""' to make sure the file exists when the jail starts - (new) additional flag to jail to write a jid file - redirect to the consolelog, it is still open from the echo when the jail starts so there's no race I did test "(echo 1; sleep 60 ; echo 2) >/tmp/test" in /bin/sh, and it is line buffered, so the above works. Where's the security problem in the above? Bye, Alexander. -- I wore my extra loose pants for nothing. Nothing! -- Homer Simpson New Kid on the Block http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID = B0063FE7 http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID = 72077137