jail and uname
m.seaman at infracaninophile.co.uk
Sat Jul 3 07:07:29 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
On 03/07/2010 07:13:13, Aiza wrote:
> From the console of a jail I issue uname –r and get 8.0-RELEASE-p3,
> which is the release level of the host. I know the jail is running a
> pristine minimum install of 8.0-RELEASE.
The uname information is compiled into the kernel -- so all jails will
show the information relevant to the host system. The problem arises
when a security patch applies to userland, and not the kernel, as
updating the host system does not necessarily mean the update has been
applied to the jails.
> I would think issuing uname from within a jail environment should
> respond with the info of the jail environment. Is this not a security
It can result in security problems, yes. The real problem there is an
incorrect approach to applying security updates to jailed systems. Even
so, not having a reliable means of telling per-jail that patches have or
have not been applied is a flaw.
Whether you can do this within the POSIX specification for uname without
adversely affecting backwards compatibility is a good question
Perhaps a simple solution would be to compile a constant string value
showing system version and patch level into libc.so and have a small
utility to print that data out. Since this is independent of the
kernel, it should fulfill the requirements, but it does mean that
*every* system update requires a new libc.so and hence a restart of all
running processes to apply fully.
While I'm here -- why doesn't FreeBSD use a simple version number like
7.3.4 rather than saying 7.3-RELEASE-p4? I realize that historically
there have been point releases like 5.2.1-RELEASE but the whole
Security/Errata branch concept was developed partly in response to such
things, and the whole release engineering process is done differently now.
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
JID: matthew at infracaninophile.co.uk Kent, CT11 9PW
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
More information about the freebsd-questions