download

System Configuration—JailsJail SecuritySecurity is one of the main concerns while running the jails. A jail is supposed tobe limited and completely harmless for the host system as well as the other jails. Ifan attacker gains access to a jail, he should not be able to escape from the jail andthe scope of vulnerability has to be limited to the compromised jail. The systemadministrator should take special care, while running the jails. Also, as all the jailsshare the same running kernel with the host system, having uncontrolled accessfrom inside a jail to the kernel will cause major security problems. For example,a misconfigured jail can be used to access the resources on the other jails (or hostsystem), or interfere with the operations of the other jails.While the jail's infrastructure does not let the imprisoned process access outside thescope of jails, a misconfigured system may unintentionally provide direct accessto the devices (via /dev device nodes), which could affect the whole system (forexample, network interface or memory).The devfs(5) mount is the jail's achilles heel. Jails should have a /dev mountpoint which contains device nodes from the device file system. The major securityissues are caused due to the full access to the host system's devfs(5) namespace.For example, a user inside a jail can read the console's message buffer or access thephysical hardware connected to the host system, which is not desirable in most cases.Luckily, devfs supports rulesets that can control the attributes of the device nodesin each devfs mount point. A devfs ruleset is a set of rules that specifies accesspermissions as well as visibility of each and every device node that lives in the devfsnamespace. For example, you can hide certain device nodes (such as disk nodes,console, or terminals) from being shown in the /dev mount point inside a jail.If you are starting a jail using /etc/rc.d/jail rc script, a default devfs ruleset isapplied to the /dev mount point of the jail. The /dev mount inside the jail will looklike the following:# ls /devfd null ptyp1 random stdin ttyp0 ttyp2 zerolog ptyp0 ptyp2 stderr stdout ttyp1 urandomYou can define your own devfs ruleset in the /etc/devfs.rules file. However, ifnothing is specified, settings from the /etc/defaults/devfs.rules will be used.You can find default jails ruleset under the devfsruleset_jail section.Revealing inappropriate device nodes under a jail environment maylead to major security issues for your host system, when a jail is beingcompromised. Reveal device nodes with caution.[ 84 ]