From owner-cvs-doc@FreeBSD.ORG  Sun May  8 12:11:22 2011
Return-Path: <owner-cvs-doc@FreeBSD.ORG>
Delivered-To: cvs-doc@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C91FA1065743;
	Sun,  8 May 2011 12:11:22 +0000 (UTC) (envelope-from bcr@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id B84248FC13;
	Sun,  8 May 2011 12:11:22 +0000 (UTC)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.4/8.14.4) with ESMTP id p48CBMjw091974;
	Sun, 8 May 2011 12:11:22 GMT (envelope-from bcr@repoman.freebsd.org)
Received: (from bcr@localhost)
	by repoman.freebsd.org (8.14.4/8.14.4/Submit) id p48CBMHG091973;
	Sun, 8 May 2011 12:11:22 GMT (envelope-from bcr)
Message-Id: <201105081211.p48CBMHG091973@repoman.freebsd.org>
From: Benedict Reuschling <bcr@FreeBSD.org>
Date: Sun, 8 May 2011 12:11:22 +0000 (UTC)
To: doc-committers@FreeBSD.org, cvs-doc@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: doc/en_US.ISO8859-1/books/handbook/jails chapter.sgml
X-BeenThere: cvs-doc@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the doc and www trees <cvs-doc.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-doc>,
	<mailto:cvs-doc-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-doc>
List-Post: <mailto:cvs-doc@freebsd.org>
List-Help: <mailto:cvs-doc-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-doc>,
	<mailto:cvs-doc-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 08 May 2011 12:11:22 -0000

bcr         2011-05-08 12:11:22 UTC

  FreeBSD doc repository

  Modified files:
    en_US.ISO8859-1/books/handbook/jails chapter.sgml 
  Log:
  Jails have a problem in that if the jail directory is world-readable, an
  attacker with root access to the jail can create a setuid binary for their
  own use in the host environment (if they also have this access), thus
  breaking root in the host.
  
  This exploit is impossible if the jail's files are not world-readable.
  Add instructions to the handbook on how to create a jail with the
  correct permissions set.
  
  PR:                     docs/156853
  Submitted by:   Chris Rees (utisoft at gmail dot com)
  Reviewed by:    cperciva (security parts)
  
  Revision  Changes    Path
  1.23      +13 -3     doc/en_US.ISO8859-1/books/handbook/jails/chapter.sgml