-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 7/27/11 10:19 PM, Jason Hellenthal wrote: >> +.Sh NOTES +Great care should be taken when managing directories >> visible within the jail. +For example, if a jailed process has its >> current working directory set to a +directory that is moved out of >> the jail's chroot, then the process may gain +access to the file >> space outside of the jail. +It is recommended that directories >> always be copied, rather than moved, out +of a jail. > > How is either one of these different ? > > All mv(1) is doing is a cp(1) & rm(1). In either case the filehandle > is still broken and a process is not going to just get up and move > with it. On the other side though if you copied a pipe or socket or > something similiar for example into a jail then it might make > whatever is outside available to the jailed environment. > > Is there something I am misunderstanding about this ? has the way > cp(1), rm(1) & mv(1) been changed recently ? or is this wording a > little off ?
The text in the example is just an example of a situation where it may be possible for a process within a jail(8) to gain filesystem access outside of the jail(8). Regards, - -- Glen Barber | g...@freebsd.org FreeBSD Documentation Project -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) iQEcBAEBCAAGBQJOMM7rAAoJEFJPDDeguUajw7gIALesuCIHff5+p/a4v3gCYetF Su1RWFH/4Cc7iETC0sBR8vvJM9tUXuuKgSXCMswqmOQeJgwE5F+Xv4zAqofVyG6x b/C0WkmEe+nShOx1JLpmyvoSXlyh7b9QxV/41Kf/0Z1EoUZSNz1q5X58ZCvelaTr pqwftcCqGp0qHxVphCq8q42Z8hzS0V2SMco7gD/dqzyKjmST0zAhQfOgrT8kAqiH JHSU8ZSjVjQ5GPKi68fVCUBsivp/hyrXviSfFwh+anBembPrzMQNS7oYBtSJCrpf Ksy5SrT+JLNTSSZlhnqIvhwLfk01LR4alryZAlXYyUqO+DDjFX11vFqCW8qPrw8= =iXr5 -----END PGP SIGNATURE----- _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
