From nobody@FreeBSD.org  Thu Oct  8 08:54:13 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2131B1065670
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Oct 2009 08:54:13 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 10B4D8FC1E
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Oct 2009 08:54:13 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n988sChV017069
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 8 Oct 2009 08:54:12 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n988sCFc017068;
	Thu, 8 Oct 2009 08:54:12 GMT
	(envelope-from nobody)
Message-Id: <200910080854.n988sCFc017068@www.freebsd.org>
Date: Thu, 8 Oct 2009 08:54:12 GMT
From: Andrey Groshev <greenx@yartv.ru>
To: freebsd-gnats-submit@FreeBSD.org
Subject: make the jail safe for the parent system
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         139422
>Category:       kern
>Synopsis:       [jail] make the jail safe for the parent system
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    remko
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Oct 08 09:00:07 UTC 2009
>Closed-Date:    Mon Jul 12 17:27:28 UTC 2010
>Last-Modified:  Mon Jul 12 17:27:28 UTC 2010
>Originator:     Andrey Groshev
>Release:        7.2-STABLE
>Organization:
YaroslavlTeleset
>Environment:
FreeBSD ear.yartelenet.ru 7.2-STABLE FreeBSD 7.2-STABLE #0: Mon Oct  5 13:56:49 MSD 2009     rootxxxxxxxx.ru:/usr/obj/usr/src/sys/earker  amd64
>Description:
There is I and my server.
Also there is other person a server responsible for a web.
Periodically he wants that I would instal some software, but in my representation, this software bad or unnecessary.
I wish to make jail for its and its software.
To give to this person complete access to it, let does all that wants.
But, if in the jail create wrong start scripts, then the parent system too cannot be started up to the end.

>How-To-Repeat:
For example: in jail  in /etc/rc.local write /bin/sh
And that starts all after this prison will not receive handle. 
>Fix:
Menshikov Konstantin in maillist advised:

I`m think, that this is bug in /etc/rc.d/jail script.
You can fix /etc/rc.d/jail
626 run_rc_command "${cmd}" &
627 sleep 5
instead
626 run_rc_command "${cmd}" 

This work.

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: remko 
State-Changed-When: Thu Oct 8 10:32:10 UTC 2009 
State-Changed-Why:  
Hello, I think I understand what you ar etrying to say here. But I think 
that only trusted people should be allowed into a jail, as well as with 
a regular server. You could give the user sudo access for specific tasks 
so tht he cannot do everything as highly privileged user. Yes ofcourse 
you might be able to get out of those things if you are creative. The 
question is, where do we put the line. I think that in this case one 
should know what he puts in rc.local, if this is a jail, and you use the 
regular scripts, the 'jail' rc.d will not be used at all. Please discuss 
this further on the questions list, and report to me in case this is 
really a problem. Anyway; thanks for using FreeBSD! It's greatly 
appreciated... 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139422 
State-Changed-From-To: closed->open 
State-Changed-By: remko 
State-Changed-When: Thu Oct 8 13:09:35 UTC 2009 
State-Changed-Why:  
Jip, you are right. I tested this, and it seems to be the 
case. I will look into resolving this. 

Thanks, 
Remko 


Responsible-Changed-From-To: freebsd-bugs->remko 
Responsible-Changed-By: remko 
Responsible-Changed-When: Thu Oct 8 13:09:35 UTC 2009 
Responsible-Changed-Why:  
Jip, you are right. I tested this, and it seems to be the 
case. I will look into resolving this. 

Thanks, 
Remko 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139422 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/139422: commit references a PR
Date: Mon,  2 Nov 2009 09:56:56 +0000 (UTC)

 Author: remko
 Date: Mon Nov  2 09:56:46 2009
 New Revision: 198785
 URL: http://svn.freebsd.org/changeset/base/198785
 
 Log:
   Execute the start/stop process of a jail in the background.
   This will prevent that the script hangs during startup, which
   could cause annoying effects after rebooting for example.
   
   PR:		kern/139422
   Submitted by:	Andrey Groshev <greenx at yartv dot ru>
   Approved by:	imp (mentor, implicit)
   MFC after:	3 days
   Facilitated by:	Snow B.V.
 
 Modified:
   head/etc/rc.d/jail
 
 Modified: head/etc/rc.d/jail
 ==============================================================================
 --- head/etc/rc.d/jail	Mon Nov  2 09:47:41 2009	(r198784)
 +++ head/etc/rc.d/jail	Mon Nov  2 09:56:46 2009	(r198785)
 @@ -728,4 +728,4 @@ fi
  if [ -n "$*" ]; then
  	jail_list="$*"
  fi
 -run_rc_command "${cmd}"
 +run_rc_command "${cmd}" &
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: remko 
State-Changed-When: Mon Nov 2 10:01:32 UTC 2009 
State-Changed-Why:  
Imported in HEAD. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139422 
State-Changed-From-To: patched->closed 
State-Changed-By: remko 
State-Changed-When: Mon Jul 12 17:27:27 UTC 2010 
State-Changed-Why:  
This had been implemented differently by Alexander Leidinger, which is 
the way to go imo. No longer needed to keep this open. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139422 
>Unformatted:
