svn commit: r224462 - stable/8/usr.sbin/jail
gjb at FreeBSD.org
Thu Jul 28 03:19:10 UTC 2011
-----BEGIN PGP SIGNED MESSAGE-----
On 7/27/11 10:19 PM, Jason Hellenthal wrote:
>> +.Sh NOTES +Great care should be taken when managing directories
>> visible within the jail. +For example, if a jailed process has its
>> current working directory set to a +directory that is moved out of
>> the jail's chroot, then the process may gain +access to the file
>> space outside of the jail. +It is recommended that directories
>> always be copied, rather than moved, out +of a jail.
> How is either one of these different ?
> All mv(1) is doing is a cp(1) & rm(1). In either case the filehandle
> is still broken and a process is not going to just get up and move
> with it. On the other side though if you copied a pipe or socket or
> something similiar for example into a jail then it might make
> whatever is outside available to the jailed environment.
> Is there something I am misunderstanding about this ? has the way
> cp(1), rm(1) & mv(1) been changed recently ? or is this wording a
> little off ?
The text in the example is just an example of a situation where it may
be possible for a process within a jail(8) to gain filesystem access
outside of the jail(8).
Glen Barber | gjb at FreeBSD.org
FreeBSD Documentation Project
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
-----END PGP SIGNATURE-----
More information about the svn-src-stable-8