Date: Sat, 18 Nov 2017 22:06:52 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 223327] dhclient: close the pidfile before calling chroot(2) Message-ID: <bug-223327-8-0vXl2ywhPG@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-223327-8@https.bugs.freebsd.org/bugzilla/> References: <bug-223327-8@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D223327 Jilles Tjoelker <jilles@FreeBSD.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jilles@FreeBSD.org Status|New |Open --- Comment #2 from Jilles Tjoelker <jilles@FreeBSD.org> --- Although kern.chroot_allow_open_directories can be bypassed trivially via U= nix domain socket file descriptor passing, it does serve a purpose in pointing = out open chroots and jails like this one. The open directory allows full access= to the / that dhclient was started from, defeating its chroot to /var/empty. In capability mode where ".." is disallowed, there is still full access to /var/run. It looks like the status quo is that the pidfile will not be removed when dhclient aborts after chrooting. The pidfile_remove() call will always fail. Before r322369 this was the case because of the chroot, and after r322369 t= his was the case because dhclient limits the pidfile descriptor to no rights (so that pidfile_verify() will fail). If this status quo is acceptable, the fix is to close the directory file descriptor using a newly added pidfile(3) function. If the status quo is not acceptable, it could be fixed by adding a not chro= oted non-capmode intermediate process to do the remove or by moving the dhclient pidfile into its own directory and fixing the rights on the pidfile and directory descriptors. The latter also requires an addition to the pidfile(= 3) API. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-223327-8-0vXl2ywhPG>