Date: Wed, 8 Oct 2003 15:30:17 -0700 (PDT) From: Kris Kennaway <kris@obsecurity.org> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/55568: DUMP has access to block devices in a JAIL Message-ID: <200310082230.h98MUH8Z007595@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/55568; it has been noted by GNATS. From: Kris Kennaway <kris@obsecurity.org> To: mjoyner <mjoyner@rv1.dynip.com> Cc: FreeBSD-gnats-submit@FreeBSD.org Subject: Re: kern/55568: DUMP has access to block devices in a JAIL Date: Wed, 8 Oct 2003 15:23:02 -0700 --r5Pyd7+fXNt84Ff3 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Aug 13, 2003 at 09:04:06PM -0400, mjoyner wrote: > A jailed root user can use DUMP and gain a snapshot of the > entire disk. > From there the jailed root user can restore files from the HOST > SYSTEM > or any other jails at their leisure. Only if the administrator has configured the jail with the raw disk devices. As you note, this is a security risk. > Even if DEVFS is not mounted, a root user could possibly create a > device node anyways, and one needs TTYS anyways. I believe this to be untrue. root cannot make device nodes once inside a jail. Kris --r5Pyd7+fXNt84Ff3 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/hI5GWry0BWjoQKURAhUDAJ9ur2Mx80oBoMLiVeureSPO0yn24gCfTAg5 dpRlB3rsH/h95CnJTrJ8xVw= =2bQ5 -----END PGP SIGNATURE----- --r5Pyd7+fXNt84Ff3--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200310082230.h98MUH8Z007595>