Bug 80242 - [patch] jail(8) should be able to set kern.securelevel inside the prison
Summary: [patch] jail(8) should be able to set kern.securelevel inside the prison
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 5.4-STABLE
Hardware: Any Any
: Normal Affects Only Me
Assignee: Matteo Riondato
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-04-22 11:50 UTC by Frank Behrens
Modified: 2006-05-26 11:33 UTC (History)
0 users

See Also:


Attachments
jailseclevel.patch (2.24 KB, patch)
2005-04-22 11:50 UTC, Frank Behrens
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Behrens 2005-04-22 11:50:18 UTC
jail(8) should be able to set kern.securelevel

As described in man jail(8) the kern.securelevel in a jail can raised independent
of host securelevel. If the jail is run with a user other than root
(option -u or -U) this user can not change the securelevel. Therefore
the securelevel must raised before the user is changed and this can
be done in jail(8) only.

jail(8) needs an option to be able to raise the securelevel in a jail
if the jail is run with a restricted user. A workaround would be
a suid executable inside the jail, but this is refused due to
security constraints.

Fix: The following patch implements the option to raise the
kern.securelevel inside a newly created jail.

How-To-Repeat: Start a jail with other user (option -u or -U) and try to raise
the securelevel in the jail without any suid executable.
Comment 1 Matteo Riondato freebsd_committer freebsd_triage 2006-03-20 19:08:37 UTC
Responsible Changed
From-To: freebsd-bugs->matteo

Grab ownership. I'm interested in jails.
Comment 2 Matteo Riondato freebsd_committer freebsd_triage 2006-05-11 14:04:58 UTC
State Changed
From-To: open->patched

Patch committed to HEAD. I will MFC it in 2 weeks
Comment 3 Matteo Riondato freebsd_committer freebsd_triage 2006-05-26 11:32:40 UTC
State Changed
From-To: patched->closed

Fixed and MFC'ed