Re: unprivileged users are able to kill certain jailed processes

Robert Watson schrieb:
> On Sun, 5 Feb 2006, [ISO-8859-15] Björn König wrote:
> 
>> unprivileged users of the host environment can see jailed processes 
>> with the same user ID. Furthermore they are able to send signals to 
>> these processes. I think since users are not allowed to imprison 
>> processes there is no reason why they should see them or even kill them.
>>
>> Someone pointed me to this issue and I want to know what you think 
>> about this.
> 
> 
> I recognize the concern, but the current behavior is consistent with the 
> overall behavior of jail.  In attempt to enforce stronger isolation 
> between the host and the jail, you will run into other, more significant 
> problems. For example, jail relies on chroot to segment the file system 
> name space. Since the host environment is typically rooted at the "real" 
> root, and guest environments are typically chrooted to specific 
> subtrees, containment is enforced (subject to due care).  However, file 
> system access control isn't aware of jails, so a uid in the host 
> environment still "owns" files that appear in the chrooted name spaces.  
> I.e., uid 1000 can edit /home/rwatson/foo, but also 
> /jail1/home/rwatson/foo if the uid matches. Changing this will be quite 
> difficult, probably to the point of being undesirable.
> 
> So I guess the question is: if we can't close the file system method of 
> processes in the host influencing processes in the jail, does it make 
> sense to, say, control the delivery of signals?

You're right. It does not.

That means you have to consider that the host environment need to be 
trustworthy if you use jails and as long as you can't guarantee strict 
isolation of the host environment from the point of view of unprivileged 
users it would be the wrong way to obscure jails from these users 
partially, like I suggested.

Thanks for your clarification.

Björn