Install -S Not Safe was: Re: Installworld deletes libc

Jason C. Wells jcw at
Sun Sep 21 23:06:35 UTC 2008

Jason C. Wells wrote:
> Jason C. Wells wrote:

> I should add that 'systcl security.jail.chflags_allowed=1' allowed 
> installworld to proceed without error. That solves my immediate problem. 
>  There appears to be a bug in the security mechanism.

The reason there appeared to be a bug in the security mechanism is that 
I performed (IIRC) chflags -noschg on libc as root on the host system 
outside the jail.

But for some reason 'install -S' was not safe.

(outside the jail)
~$ chflags noschg /usr/jails/cr/lib/

(inside the jail)
[root at s4cr /usr/src/lib/libc]# ls -lao /lib/
-rwxr-xr-x  1 root  wheel  - 981331 Sep 21 15:57 /lib/

[root at s4cr /usr/src/lib/libc]# sysctl -a | grep secur
kern.securelevel: -1
security.jail.chflags_allowed: 0

[root at s4cr /usr/src/lib/libc]#   make install
install -C -o root -g wheel -m 444   libc.a /usr/lib
install -C -o root -g wheel -m 444   libc_p.a /usr/lib
install -s -o root -g wheel -m 444   -fschg -S /lib
install: /lib/ chflags: Operation not permitted
*** Error code 71

Stop in /usr/src/lib/libc.

[root at s4cr /usr/src/lib/libc]# ls -lao /lib/
/libexec/ Shared object "" not found, required by "ls"
[root at s4cr /usr/src/lib/libc]#


More information about the freebsd-stable mailing list