From nobody Fri Aug 16 17:12:40 2024 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WlpTP1z0dz5TG3g; Fri, 16 Aug 2024 17:12:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WlpTP0rdmz4qSl; Fri, 16 Aug 2024 17:12:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1723828361; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pgtCP6+5myvnBH8J87eeBRCew6cCpMuo/E6EwG4jgbE=; b=pTXz0p+99cVF9VbiVaFjHOw7Re6QPrKf/URm9nnJcNd/Lt4YcUEq5xjxqcNVrdp6n5mV0D WkXRBbFTu/RckrwU0u3wxHlsKXpiRQAYzLpchJFTag1iJ9prwu/tWek+XlmGR4g+Jz83ZA tiamIfmbBuHj0Ko/utSsAlJgI9eCT16N1fjXf+P7xv/PZxG46nxCevGI9emzurUCXcF+Qm tGxNiEBoPTC1KPDbe3r6JCpzpgQdpQXU1zIxV/7yoe3dvUzueH9VQ/WltwgQxkL7EAp7VD c2E6cSG7Q0bwPLoAPPRj7BsN1pgw1PShWquk5bkSsCscFwOIJpZulT2ty2m+IA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1723828361; a=rsa-sha256; cv=none; b=ifysY1W9Q/mjMT7JMakgVXUezt3jskztmY+6m6hDi7B5otevd8DmnYNjp7d2c7LVHwouIw yyCNHy8TCCnhx4B+LCDMrSqEjxkQfqjPSOVMN2XV8Qel3muQ2QO/fKiiuZ3TEmzRgHZkti R1I7T5RCjurd0WRzZlcLq4O7cAgdYsEiJpxQaC4XcjvmKSmQjx0/n3oBft7jHNHVVjBIM6 FfpdW5ksbM+H5NAYcO0uLcnjAiV81pFx87bcfUHwdJow2ZrOEt2Bpc9402SKGsRd1Ou1UK mGKjYyrO7tISRL+HG5I+XaEZSp9xFuOif21BJkJlboVZn71Zdng+zUXGysILew== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1723828361; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pgtCP6+5myvnBH8J87eeBRCew6cCpMuo/E6EwG4jgbE=; b=CWIB8A4jZ6T7N+AmeZ5xQNXwm+UIcpAVtWC86DV9es8+BWSyjbcHgjEbYG05uc/0TyidDX 1TL4ZTH4H2TR+X1ceRp9iPBkEvw1N18zQ9uyJiamd1iYj7oV6B4hXdHeiaFY7cUn7Hv8/k USohsTvsb9HeTy91ZkDHlFlfxdGQxKplqTGFZ14n7q0PiWjPbHxwLs5Rrpaho98MKeo+tI 5MXHqZhQe1zYdMx52glS/K1MZMDLP1Bgk5BswYWJO2+4DLDUOwNGtR43pAmrabaB60cgFp FsZwxJamWbJGPEjBDVrMxac1gjXD1zNd7drthss129cWmb3+VLErDKArzdaXaA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WlpTP0RFDzFlv; Fri, 16 Aug 2024 17:12:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 47GHCeoT049205; Fri, 16 Aug 2024 17:12:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 47GHCe3m049202; Fri, 16 Aug 2024 17:12:40 GMT (envelope-from git) Date: Fri, 16 Aug 2024 17:12:40 GMT Message-Id: <202408161712.47GHCe3m049202@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: 1ff3118d72b1 - stable/14 - MFC jail: only chdir to user's home directory when user is specified List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 1ff3118d72b15fb4c02ee156a5073e3e40528587 Auto-Submitted: auto-generated The branch stable/14 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=1ff3118d72b15fb4c02ee156a5073e3e40528587 commit 1ff3118d72b15fb4c02ee156a5073e3e40528587 Author: Jamie Gritton AuthorDate: 2024-08-12 22:23:28 +0000 Commit: Jamie Gritton CommitDate: 2024-08-16 17:12:24 +0000 MFC jail: only chdir to user's home directory when user is specified jail(8) with the "exec.clean" parameter not only cleans the enviromnent variables before running commands, but also changes to the user's home directory. While this makes sense when auser is specified (via one of the exec.*_user parameters), it leads to all commands being run in the jail's /root directory even in the absence of an explicitly specified user. This can lead to problems when e.g. rc scripts are run from that non-world-readable directory, and run counter to expectations that jail startup is analogous to system startup. Restrict this behvaiour to only users exlicitly specified, either via the command line or jail parameters, but not the implicit root user. While this changes long-stand practice, it's the more intuitive action. jexec(8) has the same problem, and the same fix. PR: 277210 Reported by: johannes.kunde at gmail Differential Revision: https://reviews.freebsd.org/D46226 (cherry picked from commit 5cf705491727dd963485f9911ee3d52c3bf148db) --- usr.sbin/jail/command.c | 2 +- usr.sbin/jail/jail.8 | 7 ++++++- usr.sbin/jexec/jexec.8 | 7 ++++++- usr.sbin/jexec/jexec.c | 2 +- 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/usr.sbin/jail/command.c b/usr.sbin/jail/command.c index 9eabcc5ff53c..9004b4729fec 100644 --- a/usr.sbin/jail/command.c +++ b/usr.sbin/jail/command.c @@ -764,7 +764,7 @@ run_command(struct cfjail *j) setenv("HOME", pwd->pw_dir, 1); setenv("SHELL", *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1); - if (clean && chdir(pwd->pw_dir) < 0) { + if (clean && username && chdir(pwd->pw_dir) < 0) { jail_warnx(j, "chdir %s: %s", pwd->pw_dir, strerror(errno)); exit(1); diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8 index 3a6e46b065b2..75a0b86eed4c 100644 --- a/usr.sbin/jail/jail.8 +++ b/usr.sbin/jail/jail.8 @@ -23,7 +23,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 24, 2024 +.Dd August 12, 2024 .Dt JAIL 8 .Os .Sh NAME @@ -847,8 +847,13 @@ are set to the target login's default values. is set to the target login. .Ev TERM is imported from the current environment. +.Ev PATH +is set to "/bin:/usr/bin". The environment variables from the login class capability database for the target login are also set. +If a user is specified (as with +.Va exec.jail_user ) , +commands are run from that (possibly jailed) user's directory. .It Va exec.jail_user The user to run commands as, when running in the jail environment. The default is to run the commands as the current user. diff --git a/usr.sbin/jexec/jexec.8 b/usr.sbin/jexec/jexec.8 index 4400cbbe56a3..431978c4d0ae 100644 --- a/usr.sbin/jexec/jexec.8 +++ b/usr.sbin/jexec/jexec.8 @@ -23,7 +23,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd October 7, 2023 +.Dd August 12, 2024 .Dt JEXEC 8 .Os .Sh NAME @@ -55,6 +55,11 @@ The environment is discarded except for and anything from the login class capability database for the user. .Ev PATH is set to "/bin:/usr/bin". +If a user is specified (via +.Fl u +or +.Fl U ) , +commands are run from that (possibly jailed) user's directory. .It Fl u Ar username The user name from host environment as whom the .Ar command diff --git a/usr.sbin/jexec/jexec.c b/usr.sbin/jexec/jexec.c index 7a32efa34031..35fd9c8d20e4 100644 --- a/usr.sbin/jexec/jexec.c +++ b/usr.sbin/jexec/jexec.c @@ -129,7 +129,7 @@ main(int argc, char *argv[]) setenv("HOME", pwd->pw_dir, 1); setenv("SHELL", *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1); - if (clean && chdir(pwd->pw_dir) < 0) + if (clean && username && chdir(pwd->pw_dir) < 0) err(1, "chdir: %s", pwd->pw_dir); endpwent(); }