Date: Mon, 11 Jul 2005 21:49:55 GMT From: Ron van Daal <bugreport@tux.linux666.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/83297: Possible issue with FreeBSD 5.4 jailing and BPF Message-ID: <200507112149.j6BLntph039574@www.freebsd.org> Resent-Message-ID: <200507112150.j6BLoGmn090354@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 83297 >Category: misc >Synopsis: Possible issue with FreeBSD 5.4 jailing and BPF >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jul 11 21:50:16 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Ron van Daal >Release: FreeBSD 5.4-RELEASE >Organization: Syntonic Internet >Environment: FreeBSD jail 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Sun May 8 10:21:06 UTC 2005 root@harlow.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: While playing around with FreeBSD 5.4 and jailing I discovered that it was possible to put an ethernet interface into promiscious mode from within the jailed environment, allowing a packetsniffer to gather data not meant for the jailed box. This also affects FreeBSD 5.3 (tested) but not FreeBSD 4.x This can be reproduced on boxes where BPF support is enabled in the kernel and a BPF device is available in the jail (badly configured devfs/no rules) The problem lies within the FreeBSD 5.x BPF kernel code: "The Berkeley Packet Filter provides a raw interface to data link layers in a protocol independent fashion. The function bpfopen() opens an Ethernet device. There is a conditional which disallows any jailed processes from accessing this function." This conditional was present in the 4.x series kernels but is missing in 5.x and thus allowing free access to bpfopen() from within a jailed environment. I think this is related to the changed jailing code between these kernels. I don't believe this has been left out on purpose in favor of devfs rulesets (...) If not, I'd like to have some comments on this. Conclusion: Usage of devfs rulesets is highly recommended as stated in the manpages. Though a misconfiguration at this point would expose a big security issue. The question is: should bpfopen() in bpf.c check for a jailed proc or not? >How-To-Repeat: Use a FreeBSD 5.4 or 5.3 kernel which has BPF support compiled in, e.g. stock FreeBSD 5-4-RELEASE. Create a jailing environment, mount the devfs filesystem (without rules) and start the jail. Check if there's a BPF device. It's now possible to put your ethernet card in promiscious mode using e.g. tcpdump. >Fix: I believe there must be a condition in bpfopen() (file /usr/src/sys/net/bpf.h) which checks for a jailed process. E.g. like the code in 4.x kernel BPF code: if (p->p_prison) return (EPERM); >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200507112149.j6BLntph039574>