[Bug 215250] jail break under particular circumstance

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=215250

            Bug ID: 215250
           Summary: jail break under particular circumstance
           Product: Base System
           Version: 11.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: simonp at email.it

I do not understand if this is really a bug, anyway i am submitting this
because i think it could be the top of a more complex "iceberg".

How to reproduce:
--------------------------------------------------------

jailhost is the host machine
thejail is the jailed machine


remote#ssh user at thejail  // log into the jail from a remote system

thejail$su               // became superuser into the jail
thejail#cd /usr/ports    // log into any folder of the jail

Now from jailhost move the jail folder
into the jailhost hierarchy

jailhost#mv /jailz/<thejail>/usr/ports /jailz/ports // !!!

Now, from inside thejail

thejail#pwd
/jailz/ports             // !!! logged into the host   
thejail#cd ..            // you can navigate the host filesystem
thejail#pwd
/
thejail#cd etc
thejail#pwd
/etc
thejail#cat rc.conf      // see host file contents  
hostname="jailhost.mydomain"
...

thejail#uname -a         // while you are inside the jail ...
FreeBSD jailhost.mydomain 11.0-RELEASE-p1 ...

--------------------------------------------------------


I understand that this is a very particular situation
and i don't know if it is an expected behaviour
just submitting because it sounds quite unexpected ...

Cheers
Paolo

-- 
You are receiving this mail because:
You are the assignee for the bug.