-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Pawel Jakub Dawidek wrote:
> I'll keep /var/log/console.log outside a jail, because using > 'realpath -c' will be dangerous once the jail is running. There could be > a race where `realpath -c` returns one path, an attacker inside a jail > changes one of resolved path's component and rc.d/jail from outside a > jail tries to use it. A simple way to prevent race conditions (here an example to mount devfs into jails) is: cd ${jail_root} j_root=`pwd` cd ${jail_dev_dir} j_dev=`pwd` eval evil_doer=\$\{j_dev#${j_root}\} [ "$evil_doer" = "$j_dev" ] && exit mount_devfs devfs . To do the same with console.log (I _really_ like this feature and would want it re-enabled asap) you can use something like: cd ${jail_root} j_root=`pwd` cd ${jail_var_log_dir} j_var_log=`pwd` eval evil_doer=\$\{j_var_log#${j_root}\} [ "$evil_doer" = "$j_var_log" ] && exit cp -f ${temp_log} console.log Regards erdgeist -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFFq9x8ImmQdUyYEgkRAhcjAJ9DYuE4Dfe7A+MexLZ7UgQOgUd12ACgjoxO 4SlRxdYlOXsAVDvfeSeu+e8= =Xz64 -----END PGP SIGNATURE----- _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[EMAIL PROTECTED]"