I do not understand if this is really a bug, anyway i am submitting this because i think it could be the top of a more complex "iceberg". How to reproduce: -------------------------------------------------------- jailhost is the host machine thejail is the jailed machine remote#ssh user@thejail // log into the jail from a remote system thejail$su // became superuser into the jail thejail#cd /usr/ports // log into any folder of the jail Now from jailhost move the jail folder into the jailhost hierarchy jailhost#mv /jailz/<thejail>/usr/ports /jailz/ports // !!! Now, from inside thejail thejail#pwd /jailz/ports // !!! logged into the host thejail#cd .. // you can navigate the host filesystem thejail#pwd / thejail#cd etc thejail#pwd /etc thejail#cat rc.conf // see host file contents hostname="jailhost.mydomain" ... thejail#uname -a // while you are inside the jail ... FreeBSD jailhost.mydomain 11.0-RELEASE-p1 ... -------------------------------------------------------- I understand that this is a very particular situation and i don't know if it is an expected behaviour just submitting because it sounds quite unexpected ... Cheers Paolo
(In reply to simonp from comment #0) > I do not understand if this is really a bug, anyway i am submitting this > because i think it could be the top of a more complex "iceberg". If you can do the same without the following step, then it is a jail break. Otherwise is it expected behavior. IMHO. > Now from jailhost move the jail folder > into the jailhost hierarchy > > jailhost#mv /jailz/<thejail>/usr/ports /jailz/ports // !!!
Yes, it's expected behavior. It's not so much a "break" as being pulled out of the jail by an administrator with proper permission who presumably knows what he's doing. Preventing an assisted break like this would be doable, but would involve either tracing all .. traversals back to at least a prison root, or attaching a prison reference to every directory in the vnode cache. Both of those seem to be a bit of overkill. I have to admin I've done the very thing in the example: temporarily moving /usr/ports to a jail. Lately I've gone with nullfs instead, which doesn't open this hole.
(In reply to Jamie Gritton from comment #2) Thank you very much you guys, As pointed by myself the case is absolutely particular, and indeed you have no need to "break" a jail if you have admin permission for the host system ;-) ... However some unaware sysadm, or a buggy script may lead to the situation described, so, better to have had look ... thank you again