mirror of
https://github.com/opnsense/src.git
synced 2026-06-09 08:43:19 -04:00
Fix jail rc.d script privilege escalation via symlink attack against
/var/log/console.log and mount points. Security: FreeBSD-SA-07:01.jail
This commit is contained in:
Simon L. B. Nielsen
parent
6e8298db22
commit
26d67ea70f
1 changed files with 116 additions and 12 deletions
128
etc/rc.d/jail
128
etc/rc.d/jail
|
|
@ -75,6 +75,8 @@ init_variables()
|
|||
[ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}"
|
||||
eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\"
|
||||
[ -z "${_flags}" ] && _flags="-l -U root"
|
||||
eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
|
||||
[ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"
|
||||
|
||||
# Debugging aid
|
||||
#
|
||||
|
|
@ -92,6 +94,7 @@ init_variables()
|
|||
debug "$_j ruleset: $_ruleset"
|
||||
debug "$_j fstab: $_fstab"
|
||||
debug "$_j exec start: $_exec_start"
|
||||
debug "$_j consolelog: $_consolelog"
|
||||
|
||||
i=1
|
||||
while [ true ]; do
|
||||
|
|
@ -107,6 +110,7 @@ init_variables()
|
|||
|
||||
debug "$_j exec stop: $_exec_stop"
|
||||
debug "$_j flags: $_flags"
|
||||
debug "$_j consolelog: $_consolelog"
|
||||
|
||||
if [ -z "${_hostname}" ]; then
|
||||
err 3 "$name: No hostname has been defined for ${_j}"
|
||||
|
|
@ -147,6 +151,56 @@ set_sysctl()
|
|||
fi
|
||||
}
|
||||
|
||||
# is_current_mountpoint()
|
||||
# Is the directory mount point for a currently mounted file
|
||||
# system?
|
||||
#
|
||||
is_current_mountpoint()
|
||||
{
|
||||
local _dir _dir2
|
||||
|
||||
_dir=$1
|
||||
|
||||
_dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
|
||||
[ ! -d "${_dir}" ] && return 1
|
||||
_dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
|
||||
[ "${_dir}" = "${_dir2}" ]
|
||||
return $?
|
||||
}
|
||||
|
||||
# is_symlinked_mountpoint()
|
||||
# Is a mount point, or any of its parent directories, a symlink?
|
||||
#
|
||||
is_symlinked_mountpoint()
|
||||
{
|
||||
local _dir
|
||||
|
||||
_dir=$1
|
||||
|
||||
[ -L "$_dir" ] && return 0
|
||||
[ "$_dir" = "/" ] && return 1
|
||||
is_symlinked_mountpoint `dirname $_dir`
|
||||
return $?
|
||||
}
|
||||
|
||||
# secure_umount
|
||||
# Try to unmount a mount point without being vulnerable to
|
||||
# symlink attacks.
|
||||
#
|
||||
secure_umount()
|
||||
{
|
||||
local _dir
|
||||
|
||||
_dir=$1
|
||||
|
||||
if is_current_mountpoint ${_dir}; then
|
||||
umount -f ${_dir} >/dev/null 2>&1
|
||||
else
|
||||
debug "Nothing mounted on ${_dir} - not unmounting"
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
# jail_umount_fs
|
||||
# This function unmounts certain special filesystems in the
|
||||
# currently selected jail. The caller must call the init_variables()
|
||||
|
|
@ -154,27 +208,65 @@ set_sysctl()
|
|||
#
|
||||
jail_umount_fs()
|
||||
{
|
||||
local _device _mountpt _rest
|
||||
|
||||
if checkyesno _fdescfs; then
|
||||
if [ -d "${_fdescdir}" ] ; then
|
||||
umount -f ${_fdescdir} >/dev/null 2>&1
|
||||
secure_umount ${_fdescdir}
|
||||
fi
|
||||
fi
|
||||
if checkyesno _devfs; then
|
||||
if [ -d "${_devdir}" ] ; then
|
||||
umount -f ${_devdir} >/dev/null 2>&1
|
||||
secure_umount ${_devdir}
|
||||
fi
|
||||
fi
|
||||
if checkyesno _procfs; then
|
||||
if [ -d "${_procdir}" ] ; then
|
||||
umount -f ${_procdir} >/dev/null 2>&1
|
||||
secure_umount ${_procdir}
|
||||
fi
|
||||
fi
|
||||
if checkyesno _mount; then
|
||||
[ -f "${_fstab}" ] || warn "${_fstab} does not exist"
|
||||
umount -a -F "${_fstab}" >/dev/null 2>&1
|
||||
tail -r ${_fstab} | while read _device _mountpt _rest; do
|
||||
case ":${_device}" in
|
||||
:#* | :)
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
secure_umount ${_mountpt}
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
# jail_mount_fstab()
|
||||
# Mount file systems from a per jail fstab while trying to
|
||||
# secure against symlink attacks at the mount points.
|
||||
#
|
||||
# If we are certain we cannot secure against symlink attacks we
|
||||
# do not mount all of the file systems (since we cannot just not
|
||||
# mount the file system with the problematic mount point).
|
||||
#
|
||||
# The caller must call the init_variables() routine before
|
||||
# calling this one.
|
||||
#
|
||||
jail_mount_fstab()
|
||||
{
|
||||
local _device _mountpt _rest
|
||||
|
||||
while read _device _mountpt _rest; do
|
||||
case ":${_device}" in
|
||||
:#* | :)
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
if is_symlinked_mountpoint ${_mountpt}; then
|
||||
warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}"
|
||||
return
|
||||
fi
|
||||
done <${_fstab}
|
||||
mount -a -F "${_fstab}"
|
||||
}
|
||||
|
||||
jail_start()
|
||||
{
|
||||
echo -n 'Configuring jails:'
|
||||
|
|
@ -204,12 +296,16 @@ jail_start()
|
|||
if [ ! -f "${_fstab}" ]; then
|
||||
err 3 "$name: ${_fstab} does not exist"
|
||||
fi
|
||||
mount -a -F "${_fstab}"
|
||||
jail_mount_fstab
|
||||
fi
|
||||
if checkyesno _devfs; then
|
||||
# If devfs is already mounted here, skip it.
|
||||
df -t devfs "${_devdir}" >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
if is_symlinked_mountpoint ${_devdir}; then
|
||||
warn "${_devdir} has symlink as parent - not starting jail ${_jail}"
|
||||
continue
|
||||
fi
|
||||
info "Mounting devfs on ${_devdir}"
|
||||
devfs_mount_jail "${_devdir}" ${_ruleset}
|
||||
# Transitional symlink for old binaries
|
||||
|
|
@ -230,13 +326,21 @@ jail_start()
|
|||
# cd "$__pwd"
|
||||
fi
|
||||
if checkyesno _fdescfs; then
|
||||
info "Mounting fdescfs on ${_fdescdir}"
|
||||
mount -t fdescfs fdesc "${_fdescdir}"
|
||||
if is_symlinked_mountpoint ${_fdescdir}; then
|
||||
warn "${_fdescdir} has symlink as parent, not mounting"
|
||||
else
|
||||
info "Mounting fdescfs on ${_fdescdir}"
|
||||
mount -t fdescfs fdesc "${_fdescdir}"
|
||||
fi
|
||||
fi
|
||||
if checkyesno _procfs; then
|
||||
info "Mounting procfs onto ${_procdir}"
|
||||
if [ -d "${_procdir}" ] ; then
|
||||
mount -t procfs proc "${_procdir}"
|
||||
if is_symlinked_mountpoint ${_procdir}; then
|
||||
warn "${_procdir} has symlink as parent, not mounting"
|
||||
else
|
||||
info "Mounting procfs onto ${_procdir}"
|
||||
if [ -d "${_procdir}" ] ; then
|
||||
mount -t procfs proc "${_procdir}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
_tmp_jail=${_tmp_dir}/jail.$$
|
||||
|
|
@ -258,7 +362,7 @@ jail_start()
|
|||
done
|
||||
|
||||
echo -n " $_hostname"
|
||||
tail +2 ${_tmp_jail} >${_rootdir}/var/log/console.log
|
||||
tail +2 ${_tmp_jail} >${_consolelog}
|
||||
echo ${_jail_id} > /var/run/jail_${_jail}.id
|
||||
else
|
||||
jail_umount_fs
|
||||
|
|
@ -285,7 +389,7 @@ jail_stop()
|
|||
init_variables $_jail
|
||||
if [ -n "${_exec_stop}" ]; then
|
||||
eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \
|
||||
>> ${_rootdir}/var/log/console.log 2>&1
|
||||
>> ${_consolelog} 2>&1
|
||||
fi
|
||||
killall -j ${_jail_id} -TERM > /dev/null 2>&1
|
||||
sleep 1
|
||||
|
|
|
|||
Loading…
Reference in a new issue