jailutils security issue, and possible issue with 'jail'

[nie...@memberwebs.com]

Since some of you use the jailutils package, I just wanted to post some
additional info on the recent 'security fix' and also highlight a
possible issue with the 'jail' command.

http://memberwebs.com/nielsen/freebsd/jails/jailutils/security.html

It's not a very big issue (unless I'm missing something), simply one of
leaking the host environment into the jail.

This might be used legitimately in certain cases, but in most cases it's
probably a good idea to clear out the environment before executing the
jail() or jail_attach() syscalls.

The 'jstart' utility included in jailutils does this and it would
probably be a good addition to 'jexec' and/or 'jail'.

_______________________________________________
freebsd-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-securi...@freebsd.org"