bugJailkit - Bugs: bug #23493, Jailkit does not honour users with...

 
 

bug #23493: Jailkit does not honour users with the same user id

Submitter:  None
Submitted:  Thu 05 Jun 2008 12:13:36 PM UTC
   
 
Category:  None Severity:  2 - Minor
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 11 Jun 2008 01:45:01 PM UTC, comment #2: 

jk_chrootsh, jk_uchroot and jk_lsh are updated to support the situation of multiple usernames that share the same UID.

Olivier Sessink <oli4>
Group administrator
Sat 07 Jun 2008 09:48:33 PM UTC, comment #1: 

I'm not sure if posix standards allow multiple usernames to use the same user ID. I think not. If posix standards allow this this is clearly a bug. If not, perhaps an exception option can be created.

This check is not crazy b.t.w. jk_chrootsh runs with root privileges. it should make very sure that it will become the same user with the same rights inside the jail as the original user. If the account information inside the jail is different (the getpwuid() call inside the jail returns a different user from outside the jail) this is a serious sign that somebody could be tampering with access rights.

Olivier Sessink <oli4>
Group administrator
Thu 05 Jun 2008 12:13:36 PM UTC, original submission:  

Hi in this bit of code, jailkit does not honour users that are from the same user and group id. The same user id is required for users to access a web document root and have the same permissions, setup from within a control panel software.

Can the check here also do a string comparison against the group ?

if ((strcmp(pw->pw_name, oldpw_name)!=0) && (strcmp(gr->gr_name, oldgr_name)!=0)) {
  390 syslog(LOG_ERR, "abort, username %s differs from jail username %s for user ID %d, check /etc/passwd and %s/etc/passwd", oldpw_name, pw->pw_name, getuid(), jaildir);
  391 exit(37);
  392 }
  393

How about this ?  Or add a config option to disable this check. It's a pretty crazy one.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-06-11 oli4 StatusNeed Info Fixed
        Open/ClosedOpen Closed
    2008-06-07 oli4 Severity3 - Normal 2 - Minor
        StatusNone Need Info

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code