Escaping from a jail with root privileges on the host

2011-12-28 Thread Marin Atanasov Nikolov
Hello, Today I've managed to escape from a jail by accident and ended up with root access to the host's filesystem. Here's what I did: * Using ezjail for managing my jails * Verified in FreeBSD 9.0-BETA3 and 9.0-RC3 * This works only when I use sudo, and cannot reproduce if I execute

Re: Escaping from a jail with root privileges on the host

2011-12-28 Thread Bjoern A. Zeeb
On 28. Dec 2011, at 08:58 , Marin Atanasov Nikolov wrote: Hello, Today I've managed to escape from a jail by accident and ended up with root access to the host's filesystem. This has been discussed to lengths within the last year (I think it was). See the updated man page:

Re: Escaping from a jail with root privileges on the host

2011-12-28 Thread Poul-Henning Kamp
In message CAJ-UWtQnYWb8TUzk91Z+CxgfVsDM=wtbdrpp_v9pbnv7ar4...@mail.gmail.com , Marin Atanasov Nikolov writes: Then from the host machine I've moved this folder to the cwd. [...] Not sure if it is sudo or jail issue, and would be nice if someone with more experience can check this up :) That's

Re: Escaping from a jail with root privileges on the host

2011-12-28 Thread Julian Elischer
On 12/28/11 12:58 AM, Marin Atanasov Nikolov wrote: Hello, Today I've managed to escape from a jail by accident and ended up with root access to the host's filesystem. Here's what I did: * Using ezjail for managing my jails * Verified in FreeBSD 9.0-BETA3 and 9.0-RC3 * This works only

Re: Escaping from a jail with root privileges on the host

2011-12-28 Thread Stephen Montgomery-Smith
On 12/28/2011 02:58 AM, Marin Atanasov Nikolov wrote: Hello, Today I've managed to escape from a jail by accident and ended up with root access to the host's filesystem. Here's what I did: * Using ezjail for managing my jails * Verified in FreeBSD 9.0-BETA3 and 9.0-RC3 * This works only

Re: Escaping from a jail with root privileges on the host

2011-12-28 Thread Dag-Erling Smørgrav
Stephen Montgomery-Smith step...@missouri.edu writes: I agree with the poster that the jail didn't really escape, but was sprung from the outside. Easily prevented by making sure that every jail's root directory is unreachable to unprivileged users. Say your jails are in /jail/foo, /jail/bar