Date: Tue, 16 May 2000 17:02:20 -0400 (EDT) From: Geoffrey Robinson <geoff@grobin.org> To: Robert Watson <rwatson@freebsd.org> Cc: security@freebsd.org Subject: Re: Jail: Problems? Proper Usage? Status? Practicality? Message-ID: <Pine.BSF.4.10.10005161420040.77736-100000@grobin.org> In-Reply-To: <Pine.NEB.3.96L.1000516125854.15891D-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 16 May 2000, Robert Watson wrote:
> On Mon, 15 May 2000, Geoffrey Robinson wrote:
>
> >
> > ver: FreeBSD 4.0-STABLE #0: Sun May 14 11:06:58 EDT 2000
<snip>
> > aware that raw sockets are not allowed to jailed processes but is there
> > a workaround for ping and traceroute?
>
> Currently, no. Due to the way raw sockets work (allowing listening for
> all non-handled IP messages, and allowing direct writing of IP packets),
> it would take a bit of work to get this up and running, although it would
> be feasible. A more promising long-term goal might be to better
> virtualize network services, creating virtual interfaces and binding real
> network resources to virtual interfaces. However, that would be far more
> work. :-)
If a process running in the host system created a UNIX domain socket or
named pipe within the jail directory tree. Would a process running in the
jail be able to connect to and communicate with the host process through
this socket or pipe? If so I guess you could create work around for just
about anything by running it on the host system. Would this create a
potential way of defeating the jail?
> As far as I know, none of the chroot() breakout mechanisms will work from
> jail(), as long as the jail() file system is constructed and maintained in
> a safe manner. For example, jail() prevents new device nodes from being
> introduced with mknod(). However, this assumes that (a) no improper
> device nodes existed in the accessible file space in the first place, and
> (b) root outside of jail() won't create them in the file space.
What about upgrading procedures? After my last cvsup and make world
on the host system the jail could be started but could not access the
network. I had to build a new jail from scratch to get it working properly.
> Jail is being actively maintained; I have some ideas for it in the long
> term, but probably won't get to carrying them to fruition for a few
> months. This includes improved management capability (unique jailids,
> ability to deliver a signal to an entire jail from outside the jail, as
> well as special purpose binaries such as a jailinit to manage setup and
> shutdown of jails in an orderly manner. If you are interested in working
> on such features, I'd be glad to share design thoughts with you, as it
> will take me a while to get to this stuff.
I would like to try. I don't know how much help I could be. Please, let me
know what I can do. I'll do what I can.
------------------------------------------------------------------------------
| Geoffrey Robinson - geoff@grobin.org |
------------------------------------------------------------------------------
Random Fortune Quote
"MacDonald has the gift on compressing the largest amount of words into
the smallest amount of thoughts."
-- Winston Churchill
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.10005161420040.77736-100000>