From owner-freebsd-jail@freebsd.org Tue Mar 15 17:19:34 2016 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id F2575AD0352 for ; Tue, 15 Mar 2016 17:19:34 +0000 (UTC) (envelope-from mark@exonetric.com) Received: from relay.exonetric.net (relay0.exonetric.net [178.250.72.161]) by mx1.freebsd.org (Postfix) with ESMTP id C5E1614C8; Tue, 15 Mar 2016 17:19:34 +0000 (UTC) (envelope-from mark@exonetric.com) Received: from [10.2.118.214] (host86-187-120-246.range86-187.btcentralplus.com [86.187.120.246]) by relay.exonetric.net (Postfix) with ESMTPSA id B3E6C2B757; Tue, 15 Mar 2016 12:33:49 +0000 (GMT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) Subject: Re: SHM objects cannot be isolated in jails, any evolution in future FreeBSD versions? From: Mark Blackman X-Mailer: iPad Mail (13D15) In-Reply-To: <56E7C926.3020201@quip.cz> Date: Tue, 15 Mar 2016 12:33:49 +0000 Cc: Mark Felder , James Gritton , freebsd-jail@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <593EB477-D6AC-463B-A509-86A63455436F@exonetric.com> References: <0ad738494152d249f3bbe3b722a46bd2@gritton.org> <1457989662.568170.549069906.791C2D05@webmail.messagingengine.com> <56E7C926.3020201@quip.cz> To: Miroslav Lachman <000.fbsd@quip.cz> X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2016 17:19:35 -0000 On 15 Mar 2016, at 08:34, Miroslav Lachman <000.fbsd@quip.cz> wrote: >=20 > Mark Felder wrote on 03/14/2016 22:07: >>=20 >>=20 >>> On Sat, Mar 12, 2016, at 11:42, James Gritton wrote: >>>> On 2016-03-12 04:05, Simon wrote: >>>> The shm_open()(2) function changed since FreeBSD 7.0: the SHM objects >>>> path are now uncorrelated from the physical file system to become just >>>> abstract objects. Probably due to this, the jail system do not provide >>>> any form of filtering regarding shared memory created using this >>>> function. Therefore: >>>>=20 >>>> - Anyone can create unauthorized communication channels between jails, >>>> - Users with enough privileges in any jail can access and modify any >>>> SHM objects system-wide, ie. shared memory objects created in any >>>> other jail and in the host system. >>>>=20 >>>> I've seen a few claims that SHM objects were being handled differently >>>> whether they were created inside or outside a jail. However, I tested >>>> on FreeBSD 10.1 and 9.3 but found no evidence of this: both version >>>> were affected by the same issue. >>>>=20 >>>> A reference of such claim: >>>> https://lists.freebsd.org/pipermail/freebsd-ports-bugs/2015-July/312665= .html >>>>=20 >>>> My initial post on FreeBSD forum discussing the issue with more >>>> details: https://forums.freebsd.org/threads/55468/ >>>>=20 >>>> Currently, there does not seem to be any way to prevent this. >>>>=20 >>>> I'm therefore wondering if there are any concrete plans to change this >>>> situation in future FreeBSD versions? Be able to block the currently >>>> free inter-jail SHM-based communication seems a minimum, however such >>>> setting would also most likely prevent SHM-based application to work. >>>>=20 >>>> Using file based SHM objects in jails seemed a good ideas but it does >>>> not seem implemented this way, I don't know why. Is this planned, or >>>> are there any greater plans ongoing also involving IPC's similar >>>> issue? >>>=20 >>> There are no concrete plans I'm aware of, but it's definitely a thing >>> that should be done. How about filing a bug report for it? You've >>> already got a good write-up of the situation. >>=20 >> Both this and SYSV IPC jail support[1] are badly needed. >>=20 >> [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D48471 >=20 > Yes, it is very sad that original patch was not commited, nor commented or= improved by core developers for long 13 years. I am not 100% sure but I thi= ng there was some patch from PJD for SysV IPC too. There were EclipseBSD wit= h resource limits in times of FreeBSD 3.4 and there is FreeVPS for 6.x with v= irtualized IPC... >=20 > So I really hope SysV IPC aware jails will become reality soon. >=20 > Miroslav Lachman Do we have a feeling if this only a funding problem or is it an enthusiasm p= roblem? - Mark