bugJailkit - Bugs: bug #23493, Jailkit does not honour users with...

 
 

bug #23493: Jailkit does not honour users with the same user id

Submitted by:  None
Submitted on:  Thu 05 Jun 2008 12:13:36 PM UTC  
 
Category: NoneSeverity: 2 - Minor
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 11 Jun 2008 01:45:01 PM UTC, comment #2:

jk_chrootsh, jk_uchroot and jk_lsh are updated to support the situation of multiple usernames that share the same UID.

Olivier Sessink <oli4>
Project Administrator
Sat 07 Jun 2008 09:48:33 PM UTC, comment #1:

I'm not sure if posix standards allow multiple usernames to use the same user ID. I think not. If posix standards allow this this is clearly a bug. If not, perhaps an exception option can be created.

This check is not crazy b.t.w. jk_chrootsh runs with root privileges. it should make very sure that it will become the same user with the same rights inside the jail as the original user. If the account information inside the jail is different (the getpwuid() call inside the jail returns a different user from outside the jail) this is a serious sign that somebody could be tampering with access rights.

Olivier Sessink <oli4>
Project Administrator
Thu 05 Jun 2008 12:13:36 PM UTC, original submission:

Hi in this bit of code, jailkit does not honour users that are from the same user and group id. The same user id is required for users to access a web document root and have the same permissions, setup from within a control panel software.

Can the check here also do a string comparison against the group ?

if ((strcmp(pw->pw_name, oldpw_name)!=0) && (strcmp(gr->gr_name, oldgr_name)!=0)) {
390 syslog(LOG_ERR, "abort, username %s differs from jail username %s for user ID %d, check /etc/passwd and %s/etc/passwd", oldpw_name, pw->pw_name, getuid(), jaildir);
391 exit(37);
392 }
393

How about this ? Or add a config option to disable this check. It's a pretty crazy one.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by oli4 (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 11 Jun 2008 01:45:01 PM UTColi4StatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
    Sat 07 Jun 2008 09:48:33 PM UTColi4Severity3 - Normal=>2 - Minor
      StatusNone=>Need Info

    Back to the top


    Powered by Savane 3.1-cleanup1