1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-17 10:26:15 +00:00
freebsd/etc/rc.d/jail
Simon L. B. Nielsen 26d67ea70f Fix jail rc.d script privilege escalation via symlink attack against
/var/log/console.log and mount points.

Security:	FreeBSD-SA-07:01.jail
2007-01-11 18:18:57 +00:00

420 lines
10 KiB
Bash

#!/bin/sh
#
# $FreeBSD$
#
# PROVIDE: jail
# REQUIRE: LOGIN cleanvar
# BEFORE: securelevel
# KEYWORD: nojail shutdown
. /etc/rc.subr
name="jail"
rcvar=`set_rcvar`
start_cmd="jail_start"
stop_cmd="jail_stop"
# init_variables _j
# Initialize the various jail variables for jail _j.
#
init_variables()
{
_j="$1"
if [ -z "$_j" ]; then
warn "init_variables: you must specify a jail"
return
fi
eval _rootdir=\"\$jail_${_j}_rootdir\"
_devdir="${_rootdir}/dev"
_fdescdir="${_devdir}/fd"
_procdir="${_rootdir}/proc"
eval _hostname=\"\$jail_${_j}_hostname\"
eval _ip=\"\$jail_${_j}_ip\"
eval _interface=\"\${jail_${_j}_interface:-${jail_interface}}\"
eval _exec=\"\$jail_${_j}_exec\"
eval _exec_start=\"\${jail_${_j}_exec_start:-${jail_exec_start}}\"
i=1
while [ true ]; do
eval _exec_afterstart${i}=\"\${jail_${_j}_exec_afterstart${i}:-\${jail_exec_afterstart${i}}}\"
[ -z "$(eval echo \"\$_exec_afterstart${i}\")" ] && break
i=$((i + 1))
done
eval _exec_stop=\"\${jail_${_j}_exec_stop:-${jail_exec_stop}}\"
if [ -n "${_exec}" ]; then
# simple/backward-compatible execution
_exec_start="${_exec}"
_exec_stop=""
else
# flexible execution
if [ -z "${_exec_start}" ]; then
_exec_start="/bin/sh /etc/rc"
if [ -z "${_exec_stop}" ]; then
_exec_stop="/bin/sh /etc/rc.shutdown"
fi
fi
fi
# The default jail ruleset will be used by rc.subr if none is specified.
eval _ruleset=\"\${jail_${_j}_devfs_ruleset:-${jail_devfs_ruleset}}\"
eval _devfs=\"\${jail_${_j}_devfs_enable:-${jail_devfs_enable}}\"
[ -z "${_devfs}" ] && _devfs="NO"
eval _fdescfs=\"\${jail_${_j}_fdescfs_enable:-${jail_fdescfs_enable}}\"
[ -z "${_fdescfs}" ] && _fdescfs="NO"
eval _procfs=\"\${jail_${_j}_procfs_enable:-${jail_procfs_enable}}\"
[ -z "${_procfs}" ] && _procfs="NO"
eval _mount=\"\${jail_${_j}_mount_enable:-${jail_mount_enable}}\"
[ -z "${_mount}" ] && _mount="NO"
# "/etc/fstab.${_j}" will be used for {,u}mount(8) if none is specified.
eval _fstab=\"\${jail_${_j}_fstab:-${jail_fstab}}\"
[ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}"
eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\"
[ -z "${_flags}" ] && _flags="-l -U root"
eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
[ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"
# Debugging aid
#
debug "$_j devfs enable: $_devfs"
debug "$_j fdescfs enable: $_fdescfs"
debug "$_j procfs enable: $_procfs"
debug "$_j mount enable: $_mount"
debug "$_j hostname: $_hostname"
debug "$_j ip: $_ip"
debug "$_j interface: $_interface"
debug "$_j root: $_rootdir"
debug "$_j devdir: $_devdir"
debug "$_j fdescdir: $_fdescdir"
debug "$_j procdir: $_procdir"
debug "$_j ruleset: $_ruleset"
debug "$_j fstab: $_fstab"
debug "$_j exec start: $_exec_start"
debug "$_j consolelog: $_consolelog"
i=1
while [ true ]; do
eval out=\"\${_exec_afterstart${i}:-''}\"
if [ -z "$out" ]; then
break;
fi
debug "$_j exec after start #${i}: ${out}"
i=$((i + 1))
done
debug "$_j exec stop: $_exec_stop"
debug "$_j flags: $_flags"
debug "$_j consolelog: $_consolelog"
if [ -z "${_hostname}" ]; then
err 3 "$name: No hostname has been defined for ${_j}"
fi
if [ -z "${_rootdir}" ]; then
err 3 "$name: No root directory has been defined for ${_j}"
fi
if [ -z "${_ip}" ]; then
err 3 "$name: No IP address has been defined for ${_j}"
fi
}
# set_sysctl rc_knob mib msg
# If the mib sysctl is set according to what rc_knob
# specifies, this function does nothing. However if
# rc_knob is set differently than mib, then the mib
# is set accordingly and msg is displayed followed by
# an '=" sign and the word 'YES' or 'NO'.
#
set_sysctl()
{
_knob="$1"
_mib="$2"
_msg="$3"
_current=`${SYSCTL} -n $_mib 2>/dev/null`
if checkyesno $_knob ; then
if [ "$_current" -ne 1 ]; then
echo -n " ${_msg}=YES"
${SYSCTL_W} 1>/dev/null ${_mib}=1
fi
else
if [ "$_current" -ne 0 ]; then
echo -n " ${_msg}=NO"
${SYSCTL_W} 1>/dev/null ${_mib}=0
fi
fi
}
# is_current_mountpoint()
# Is the directory mount point for a currently mounted file
# system?
#
is_current_mountpoint()
{
local _dir _dir2
_dir=$1
_dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
[ ! -d "${_dir}" ] && return 1
_dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
[ "${_dir}" = "${_dir2}" ]
return $?
}
# is_symlinked_mountpoint()
# Is a mount point, or any of its parent directories, a symlink?
#
is_symlinked_mountpoint()
{
local _dir
_dir=$1
[ -L "$_dir" ] && return 0
[ "$_dir" = "/" ] && return 1
is_symlinked_mountpoint `dirname $_dir`
return $?
}
# secure_umount
# Try to unmount a mount point without being vulnerable to
# symlink attacks.
#
secure_umount()
{
local _dir
_dir=$1
if is_current_mountpoint ${_dir}; then
umount -f ${_dir} >/dev/null 2>&1
else
debug "Nothing mounted on ${_dir} - not unmounting"
fi
}
# jail_umount_fs
# This function unmounts certain special filesystems in the
# currently selected jail. The caller must call the init_variables()
# routine before calling this one.
#
jail_umount_fs()
{
local _device _mountpt _rest
if checkyesno _fdescfs; then
if [ -d "${_fdescdir}" ] ; then
secure_umount ${_fdescdir}
fi
fi
if checkyesno _devfs; then
if [ -d "${_devdir}" ] ; then
secure_umount ${_devdir}
fi
fi
if checkyesno _procfs; then
if [ -d "${_procdir}" ] ; then
secure_umount ${_procdir}
fi
fi
if checkyesno _mount; then
[ -f "${_fstab}" ] || warn "${_fstab} does not exist"
tail -r ${_fstab} | while read _device _mountpt _rest; do
case ":${_device}" in
:#* | :)
continue
;;
esac
secure_umount ${_mountpt}
done
fi
}
# jail_mount_fstab()
# Mount file systems from a per jail fstab while trying to
# secure against symlink attacks at the mount points.
#
# If we are certain we cannot secure against symlink attacks we
# do not mount all of the file systems (since we cannot just not
# mount the file system with the problematic mount point).
#
# The caller must call the init_variables() routine before
# calling this one.
#
jail_mount_fstab()
{
local _device _mountpt _rest
while read _device _mountpt _rest; do
case ":${_device}" in
:#* | :)
continue
;;
esac
if is_symlinked_mountpoint ${_mountpt}; then
warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}"
return
fi
done <${_fstab}
mount -a -F "${_fstab}"
}
jail_start()
{
echo -n 'Configuring jails:'
set_sysctl jail_set_hostname_allow security.jail.set_hostname_allowed \
set_hostname_allow
set_sysctl jail_socket_unixiproute_only \
security.jail.socket_unixiproute_only unixiproute_only
set_sysctl jail_sysvipc_allow security.jail.sysvipc_allowed \
sysvipc_allow
echo '.'
echo -n 'Starting jails:'
_tmp_dir=`mktemp -d /tmp/jail.XXXXXXXX` || \
err 3 "$name: Can't create temp dir, exiting..."
for _jail in ${jail_list}
do
init_variables $_jail
if [ -f /var/run/jail_${_jail}.id ]; then
echo -n " [${_hostname} already running (/var/run/jail_${_jail}.id exists)]"
continue;
fi
if [ -n "${_interface}" ]; then
ifconfig ${_interface} alias ${_ip} netmask 255.255.255.255
fi
if checkyesno _mount; then
info "Mounting fstab for jail ${_jail} (${_fstab})"
if [ ! -f "${_fstab}" ]; then
err 3 "$name: ${_fstab} does not exist"
fi
jail_mount_fstab
fi
if checkyesno _devfs; then
# If devfs is already mounted here, skip it.
df -t devfs "${_devdir}" >/dev/null
if [ $? -ne 0 ]; then
if is_symlinked_mountpoint ${_devdir}; then
warn "${_devdir} has symlink as parent - not starting jail ${_jail}"
continue
fi
info "Mounting devfs on ${_devdir}"
devfs_mount_jail "${_devdir}" ${_ruleset}
# Transitional symlink for old binaries
if [ ! -L "${_devdir}/log" ]; then
__pwd="`pwd`"
cd "${_devdir}"
ln -sf ../var/run/log log
cd "$__pwd"
fi
fi
# XXX - It seems symlinks don't work when there
# is a devfs(5) device of the same name.
# Jail console output
# __pwd="`pwd`"
# cd "${_devdir}"
# ln -sf ../var/log/console console
# cd "$__pwd"
fi
if checkyesno _fdescfs; then
if is_symlinked_mountpoint ${_fdescdir}; then
warn "${_fdescdir} has symlink as parent, not mounting"
else
info "Mounting fdescfs on ${_fdescdir}"
mount -t fdescfs fdesc "${_fdescdir}"
fi
fi
if checkyesno _procfs; then
if is_symlinked_mountpoint ${_procdir}; then
warn "${_procdir} has symlink as parent, not mounting"
else
info "Mounting procfs onto ${_procdir}"
if [ -d "${_procdir}" ] ; then
mount -t procfs proc "${_procdir}"
fi
fi
fi
_tmp_jail=${_tmp_dir}/jail.$$
eval jail ${_flags} -i ${_rootdir} ${_hostname} \
${_ip} ${_exec_start} > ${_tmp_jail} 2>&1
if [ "$?" -eq 0 ] ; then
_jail_id=$(head -1 ${_tmp_jail})
i=1
while [ true ]; do
eval out=\"\${_exec_afterstart${i}:-''}\"
if [ -z "$out" ]; then
break;
fi
jexec "${_jail_id}" ${out}
i=$((i + 1))
done
echo -n " $_hostname"
tail +2 ${_tmp_jail} >${_consolelog}
echo ${_jail_id} > /var/run/jail_${_jail}.id
else
jail_umount_fs
if [ -n "${_interface}" ]; then
ifconfig ${_interface} -alias ${_ip}
fi
echo " cannot start jail \"${_jail}\": "
tail +2 ${_tmp_jail}
fi
rm -f ${_tmp_jail}
done
rmdir ${_tmp_dir}
echo '.'
}
jail_stop()
{
echo -n 'Stopping jails:'
for _jail in ${jail_list}
do
if [ -f "/var/run/jail_${_jail}.id" ]; then
_jail_id=$(cat /var/run/jail_${_jail}.id)
if [ ! -z "${_jail_id}" ]; then
init_variables $_jail
if [ -n "${_exec_stop}" ]; then
eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \
>> ${_consolelog} 2>&1
fi
killall -j ${_jail_id} -TERM > /dev/null 2>&1
sleep 1
killall -j ${_jail_id} -KILL > /dev/null 2>&1
jail_umount_fs
echo -n " $_hostname"
fi
if [ -n "${_interface}" ]; then
ifconfig ${_interface} -alias ${_ip}
fi
rm /var/run/jail_${_jail}.id
else
echo " cannot stop jail ${_jail}. No jail id in /var/run"
fi
done
echo '.'
}
load_rc_config $name
cmd="$1"
if [ $# -gt 0 ]; then
shift
fi
if [ -n "$*" ]; then
jail_list="$*"
fi
run_rc_command "${cmd}"