[Bug 262179] Prevent jail escaping via shared nullfs; option to disable UNIX domain socket binding
Date: Thu, 24 Feb 2022 23:15:24 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262179 --- Comment #6 from email@example.com --- It should be noted, that there are another ways to escape jail via shared nullfs when it is done badly. I did not tried to fix them in any way, the patch is to fix jail-escaping only for properly configured nullfs: 1) both shared mounts have exactly same underlying base directory 2) underlying base directory for nullfs is placed on a separate filesystem, otherwise invisible to the jails. -- You are receiving this mail because: You are the assignee for the bug.