diff options
| author | Glen Barber <gjb@FreeBSD.org> | 2011-07-24 03:34:38 +0000 |
|---|---|---|
| committer | Glen Barber <gjb@FreeBSD.org> | 2011-07-24 03:34:38 +0000 |
| commit | 1f897ce116ef644e2560c342f3dce1d143f485a8 (patch) | |
| tree | 771a1073b2a757f514a4c5853c570d4126ef210c /usr.sbin | |
| parent | 5d5140280b5689c629efc2e663867592d49bb7bc (diff) | |
| download | src-1f897ce116ef644e2560c342f3dce1d143f485a8.tar.gz src-1f897ce116ef644e2560c342f3dce1d143f485a8.zip | |
Document the potential for jail escape.
Submitted by: Vedad KAJTAZ (vedad % kajtaz net)
PR: 142341
Reviewed by: bz, rwatson
Rewording by: rwatson
Approved by: re (kensmith)
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=224286
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/jail/jail.8 | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8 index 893efd84da56..8ed913a1eb02 100644 --- a/usr.sbin/jail/jail.8 +++ b/usr.sbin/jail/jail.8 @@ -34,7 +34,7 @@ .\" .\" $FreeBSD$ .\" -.Dd January 17, 2010 +.Dd July 23, 2011 .Dt JAIL 8 .Os .Sh NAME @@ -907,3 +907,10 @@ Currently, the simplest answer is to minimize services offered on the host, possibly limiting it to services offered from .Xr inetd 8 which is easily configurable. +.Sh NOTES +Great care should be taken when managing directories visible within the jail. +For example, if a jailed process has its current working directory set to a +directory that is moved out of the jail's chroot, then the process may gain +access to the file space outside of the jail. +It is recommended that directories always be copied, rather than moved, out +of a jail. |