kern/55568: DUMP has access to block devices in a JAIL

[mjoyner]

The following reply was made to PR kern/55568; it has been noted by GNATS.

From: mjoyner <mjoyner at rv1.dynip.com>
To: Kris Kennaway <kris at obsecurity.org>
Cc: FreeBSD-gnats-submit at FreeBSD.org
Subject: Re: kern/55568: DUMP has access to block devices in a JAIL
Date: Wed, 08 Oct 2003 23:33:50 -0400

 Where would one find documentation to prevent the jailed user from being 
 able to dump the raw partition(s)?
 
 Kris Kennaway wrote:
 > On Wed, Aug 13, 2003 at 09:04:06PM -0400, mjoyner wrote:
 > 
 > 
 >>         A jailed root user can use DUMP and gain a snapshot of the
 >>entire disk.
 >>         From there the jailed root user can restore files from the HOST
 >>SYSTEM
 >>         or any other jails at their leisure.
 > 
 > 
 > Only if the administrator has configured the jail with the raw disk
 > devices.  As you note, this is a security risk.
 > 
 > 
 >>         Even if DEVFS is not mounted, a root user could possibly create a
 >>         device node anyways, and one needs TTYS anyways.
 > 
 > 
 > I believe this to be untrue.  root cannot make device nodes once
 > inside a jail.
 > 
 > Kris