[Bug 285782] Jail escape via directory rename outside of jail $path.

[bugzilla-noreply]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285782

--- Comment #5 from Konstantin Belousov <k...@freebsd.org> ---
(In reply to Mark Johnston from comment #4)
Hm, there is already a check that should catch walking over any parent jail
root for dotdot lookup.  See vfs_lookup.c:1208 and below:

                for (;;) {
                        for (pr = cnp->cn_cred->cr_prison; pr != NULL;
                             pr = pr->pr_parent)
                                if (dp == pr->pr_root)
                                        break;
                        bool isroot = dp == ndp->ni_rootdir ||
                            dp == ndp->ni_topdir || dp == rootvnode ||
                            pr != NULL;

-- 
You are receiving this mail because:
You are the assignee for the bug.