[Bug 262179] Prevent jail escaping via shared nullfs; option to disable UNIX domain socket binding

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 24 Feb 2022 23:15:24 UTC

--- Comment #6 from firk@cantconnect.ru ---
It should be noted, that there are another ways to escape jail via shared
nullfs when it is done badly. I did not tried to fix them in any way, the patch
is to fix jail-escaping only for properly configured nullfs:

1) both shared mounts have exactly same underlying base directory
2) underlying base directory for nullfs is placed on a separate filesystem,
otherwise invisible to the jails.

You are receiving this mail because:
You are the assignee for the bug.