3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
214 lines
5.7 KiB
Diff
214 lines
5.7 KiB
Diff
Index: etc/rc.d/jail
|
|
===================================================================
|
|
RCS file: /home/ncvs/src/etc/rc.d/jail,v
|
|
retrieving revision 1.23.2.2
|
|
diff -u -d -r1.23.2.2 jail
|
|
--- etc/rc.d/jail 16 Aug 2005 08:43:06 -0000 1.23.2.2
|
|
+++ etc/rc.d/jail 9 Jan 2007 21:45:16 -0000
|
|
@@ -66,6 +66,8 @@
|
|
[ -z "${jail_fstab}" ] && jail_fstab="/etc/fstab.${_j}"
|
|
eval jail_flags=\"\$jail_${_j}_flags\"
|
|
[ -z "${jail_flags}" ] && jail_flags="-l -U root"
|
|
+ eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
|
|
+ [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"
|
|
|
|
# Debugging aid
|
|
#
|
|
@@ -84,6 +86,7 @@
|
|
debug "$_j exec start: $jail_exec_start"
|
|
debug "$_j exec stop: $jail_exec_stop"
|
|
debug "$_j flags: $jail_flags"
|
|
+ debug "$_j consolelog: $_consolelog"
|
|
}
|
|
|
|
# set_sysctl rc_knob mib msg
|
|
@@ -113,6 +116,56 @@
|
|
fi
|
|
}
|
|
|
|
+# is_current_mountpoint()
|
|
+# Is the directory mount point for a currently mounted file
|
|
+# system?
|
|
+#
|
|
+is_current_mountpoint()
|
|
+{
|
|
+ local _dir _dir2
|
|
+
|
|
+ _dir=$1
|
|
+
|
|
+ _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
|
|
+ [ ! -d "${_dir}" ] && return 1
|
|
+ _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
|
|
+ [ "${_dir}" = "${_dir2}" ]
|
|
+ return $?
|
|
+}
|
|
+
|
|
+# is_symlinked_mountpoint()
|
|
+# Is a mount point, or any of its parent directories, a symlink?
|
|
+#
|
|
+is_symlinked_mountpoint()
|
|
+{
|
|
+ local _dir
|
|
+
|
|
+ _dir=$1
|
|
+
|
|
+ [ -L "$_dir" ] && return 0
|
|
+ [ "$_dir" = "/" ] && return 1
|
|
+ is_symlinked_mountpoint `dirname $_dir`
|
|
+ return $?
|
|
+}
|
|
+
|
|
+# secure_umount
|
|
+# Try to unmount a mount point without being vulnerable to
|
|
+# symlink attacks.
|
|
+#
|
|
+secure_umount()
|
|
+{
|
|
+ local _dir
|
|
+
|
|
+ _dir=$1
|
|
+
|
|
+ if is_current_mountpoint ${_dir}; then
|
|
+ umount -f ${_dir} >/dev/null 2>&1
|
|
+ else
|
|
+ debug "Nothing mounted on ${_dir} - not unmounting"
|
|
+ fi
|
|
+}
|
|
+
|
|
+
|
|
# jail_umount_fs
|
|
# This function unmounts certain special filesystems in the
|
|
# currently selected jail. The caller must call the init_variables()
|
|
@@ -120,27 +173,65 @@
|
|
#
|
|
jail_umount_fs()
|
|
{
|
|
+ local _device _mountpt _rest
|
|
+
|
|
if checkyesno jail_fdescfs; then
|
|
if [ -d "${jail_fdescdir}" ] ; then
|
|
- umount -f ${jail_fdescdir} >/dev/null 2>&1
|
|
+ secure_umount ${jail_fdescdir}
|
|
fi
|
|
fi
|
|
if checkyesno jail_devfs; then
|
|
if [ -d "${jail_devdir}" ] ; then
|
|
- umount -f ${jail_devdir} >/dev/null 2>&1
|
|
+ secure_umount ${jail_devdir}
|
|
fi
|
|
fi
|
|
if checkyesno jail_procfs; then
|
|
if [ -d "${jail_procdir}" ] ; then
|
|
- umount -f ${jail_procdir} >/dev/null 2>&1
|
|
+ secure_umount ${jail_procdir}
|
|
fi
|
|
fi
|
|
if checkyesno jail_mount; then
|
|
[ -f "${jail_fstab}" ] || warn "${jail_fstab} does not exist"
|
|
- umount -a -F "${jail_fstab}" >/dev/null 2>&1
|
|
+ tail -r ${jail_fstab} | while read _device _mountpt _rest; do
|
|
+ case ":${_device}" in
|
|
+ :#* | :)
|
|
+ continue
|
|
+ ;;
|
|
+ esac
|
|
+ secure_umount ${_mountpt}
|
|
+ done
|
|
fi
|
|
}
|
|
|
|
+# jail_mount_fstab()
|
|
+# Mount file systems from a per jail fstab while trying to
|
|
+# secure against symlink attacks at the mount points.
|
|
+#
|
|
+# If we are certain we cannot secure against symlink attacks we
|
|
+# do not mount all of the file systems (since we cannot just not
|
|
+# mount the file system with the problematic mount point).
|
|
+#
|
|
+# The caller must call the init_variables() routine before
|
|
+# calling this one.
|
|
+#
|
|
+jail_mount_fstab()
|
|
+{
|
|
+ local _device _mountpt _rest
|
|
+
|
|
+ while read _device _mountpt _rest; do
|
|
+ case ":${_device}" in
|
|
+ :#* | :)
|
|
+ continue
|
|
+ ;;
|
|
+ esac
|
|
+ if is_symlinked_mountpoint ${_mountpt}; then
|
|
+ warn "${_mountpt} has symlink as parent - not mounting from ${jail_fstab}"
|
|
+ return
|
|
+ fi
|
|
+ done <${_fstab}
|
|
+ mount -a -F "${jail_fstab}"
|
|
+}
|
|
+
|
|
jail_start()
|
|
{
|
|
echo -n 'Configuring jails:'
|
|
@@ -167,12 +258,16 @@
|
|
if [ ! -f "${jail_fstab}" ]; then
|
|
err 3 "$name: ${jail_fstab} does not exist"
|
|
fi
|
|
- mount -a -F "${jail_fstab}"
|
|
+ jail_mount_fstab
|
|
fi
|
|
if checkyesno jail_devfs; then
|
|
# If devfs is already mounted here, skip it.
|
|
df -t devfs "${jail_devdir}" >/dev/null
|
|
if [ $? -ne 0 ]; then
|
|
+ if is_symlinked_mountpoint ${jail_devdir}; then
|
|
+ warn "${jail_devdir} has symlink as parent - not starting jail ${_jail}"
|
|
+ continue
|
|
+ fi
|
|
info "Mounting devfs on ${jail_devdir}"
|
|
devfs_mount_jail "${jail_devdir}" ${jail_ruleset}
|
|
# Transitional symlink for old binaries
|
|
@@ -193,13 +288,21 @@
|
|
# cd "$__pwd"
|
|
fi
|
|
if checkyesno jail_fdescfs; then
|
|
- info "Mounting fdescfs on ${jail_fdescdir}"
|
|
- mount -t fdescfs fdesc "${jail_fdescdir}"
|
|
+ if is_symlinked_mountpoint ${jail_fdescdir}; then
|
|
+ warn "${jail_fdescdir} has symlink as parent, not mounting"
|
|
+ else
|
|
+ info "Mounting fdescfs on ${jail_fdescdir}"
|
|
+ mount -t fdescfs fdesc "${jail_fdescdir}"
|
|
+ fi
|
|
fi
|
|
if checkyesno jail_procfs; then
|
|
- info "Mounting procfs onto ${jail_procdir}"
|
|
- if [ -d "${jail_procdir}" ] ; then
|
|
- mount -t procfs proc "${jail_procdir}"
|
|
+ if is_symlinked_mountpoint ${jail_procdir}; then
|
|
+ warn "${jail_procdir} has symlink as parent, not mounting"
|
|
+ else
|
|
+ info "Mounting procfs onto ${jail_procdir}"
|
|
+ if [ -d "${jail_procdir}" ] ; then
|
|
+ mount -t procfs proc "${jail_procdir}"
|
|
+ fi
|
|
fi
|
|
fi
|
|
_tmp_jail=${_tmp_dir}/jail.$$
|
|
@@ -207,7 +310,7 @@
|
|
${jail_ip} ${jail_exec_start} > ${_tmp_jail} 2>&1
|
|
[ "$?" -eq 0 ] && echo -n " $jail_hostname"
|
|
_jail_id=$(head -1 ${_tmp_jail})
|
|
- tail +2 ${_tmp_jail} >${jail_rootdir}/var/log/console.log
|
|
+ tail +2 ${_tmp_jail} >${_consolelog}
|
|
rm -f ${_tmp_jail}
|
|
echo ${_jail_id} > /var/run/jail_${_jail}.id
|
|
done
|
|
@@ -226,7 +329,7 @@
|
|
init_variables $_jail
|
|
if [ -n "${jail_exec_stop}" ]; then
|
|
eval env -i /usr/sbin/jexec ${_jail_id} ${jail_exec_stop} \
|
|
- >> ${jail_rootdir}/var/log/console.log 2>&1
|
|
+ >> ${_consolelog} 2>&1
|
|
fi
|
|
killall -j ${_jail_id} -TERM > /dev/null 2>&1
|
|
sleep 1
|