From corecode@corecode.ath.cx  Fri Mar 29 19:18:51 2002
Return-Path: <corecode@corecode.ath.cx>
Received: from mailout02.sul.t-online.com (mailout02.sul.t-online.com [194.25.134.17])
	by hub.freebsd.org (Postfix) with ESMTP id 4B59137B405
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 29 Mar 2002 19:18:50 -0800 (PST)
Received: from fwd07.sul.t-online.de 
	by mailout02.sul.t-online.com with smtp 
	id 16r99p-00046r-01; Sat, 30 Mar 2002 04:03:57 +0100
Received: from spirit.zuhause.stoert.net (320050403952-0001@[217.82.55.8]) by fmrl07.sul.t-online.com
	with esmtp id 16r99j-0B2ypMC; Sat, 30 Mar 2002 04:03:51 +0100
Received: from elevation.zuhause.stoert.net (elevation.zuhause.stoert.net [192.168.66.46])
	by spirit.zuhause.stoert.net (8.11.6/8.11.6) with ESMTP id g2U33oR52399
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 30 Mar 2002 04:03:50 +0100 (CET)
	(envelope-from corecode@corecode.ath.cx)
Received: (from corecode@localhost)
	by elevation.zuhause.stoert.net (8.11.6/8.11.6) id g2U33ki38379;
	Sat, 30 Mar 2002 04:03:46 +0100 (CET)
	(envelope-from corecode)
Message-Id: <200203300303.g2U33ki38379@elevation.zuhause.stoert.net>
Date: Sat, 30 Mar 2002 04:03:46 +0100 (CET)
From: "Simon 'corecode' Schubert" <corecode@corecode.ath.cx>
Reply-To: "Simon 'corecode' Schubert" <corecode@corecode.ath.cx>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: stat outside procs in procfs succeeds from within a jail
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         36522
>Category:       kern
>Synopsis:       stat outside procs in procfs succeeds from within a jail
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    des
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 29 19:20:01 PST 2002
>Closed-Date:    Tue Aug 19 03:29:06 PDT 2003
>Last-Modified:  Tue Aug 19 03:29:06 PDT 2003
>Originator:     Simon 'corecode' Schubert
>Release:        FreeBSD 4.5-STABLE i386
>Organization:
>Environment:
System: FreeBSD elevation.zuhause.stoert.net 4.5-STABLE FreeBSD 4.5-STABLE #0: Fri Mar 22 19:08:08 CET 2002 corecode@elevation.zuhause.stoert.net:/usr/obj/i386/k7/usr/src/sys/ELEVATION i386


	
>Description:
	from within a jail:
	doing a stat(2) on a process' dir/file in procfs that doesn't
	belong to the jail returns a valid result and not ENOENT, though
	readdir doesn't list these directories/files
	
>How-To-Repeat:
	# jail / elev 1 `which perl` \
		-e 'stat "/proc/$ARGV[0]" and print "valid!\n" or print "invalid!\n"' 1

	should print `invalid!', but doesn't do so.
	
>Fix:
	i'm no kernel hacker, but i assume there is a PRISON_CHECK() missing;
	i didn't check that code, just assume that. no guarantee this will even
	compile neither work!


--- /usr/src/sys/miscfs/procfs/procfs_vnops.c	Wed Jan 23 02:00:54 2002
+++ procfs_vnops.c	Sat Mar 30 04:00:51 2002
@@ -444,7 +444,7 @@
 	default:
 		procp = PFIND(pfs->pfs_pid);
 		if (procp == NULL || procp->p_cred == NULL ||
-		    procp->p_ucred == NULL)
+		    procp->p_ucred == NULL || !PRISON_CHECK(curproc, procp))
 			return (ENOENT);
 	}
 
	


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->des 
Responsible-Changed-By: kris 
Responsible-Changed-When: Fri Jul 18 15:21:30 PDT 2003 
Responsible-Changed-Why:  
Assign to procfs maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=36522 
State-Changed-From-To: open->closed 
State-Changed-By: des 
State-Changed-When: Tue Aug 19 03:29:04 PDT 2003 
State-Changed-Why:  
kern/48156 describes the same bug and contains a better patch. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=36522 
>Unformatted:
