freebsd stable - May 2007 - gmirror security problem on jail env?

# uname -a
FreeBSD xxxxxxx 6.2-STABLE FreeBSD 6.2-STABLE #0: Wed Apr 11 14:58:49  
CEST 2007     martin@xxxxx


# sysctl -a | grep jail

security.jail.set_hostname_allowed: 0
security.jail.socket_unixiproute_only: 1
security.jail.sysvipc_allowed: 0
security.jail.enforce_statfs: 2
security.jail.allow_raw_sockets: 0
security.jail.chflags_allowed: 0
security.jail.jailed: 1


# ls /dev
fd      null    ptyp1   ptyp3   ptyp5   stderr  stdout  ttyp1    
ttyp3   ttyp5   zero
log     ptyp0   ptyp2   ptyp4   random  stdin   ttyp0   ttyp2    
ttyp4   urandom

# df
Filesystem         1K-blocks     Used     Avail Capacity  Mounted on
/dev/mirror/gm0s1g 129719744 17056610 102285556    14%    /


# gmirror status
       Name    Status  Components
mirror/gm0  COMPLETE  da0
                       da1


so I think I can do...
gmirror remove.. stop.. deactive...

inside  jails!

it's true?

Manuel Martini wrote:
 > # sysctl -a | grep jail
 > [...]
 > security.jail.jailed: 1
 > # df
 > Filesystem         1K-blocks     Used     Avail Capacity  Mounted on
 > /dev/mirror/gm0s1g 129719744 17056610 102285556    14%    /
 > # gmirror status
 >        Name    Status  Components
 > mirror/gm0  COMPLETE  da0
 > 
 > so I think I can do...
 > gmirror remove.. stop.. deactive...

No, you can do "status" and "list", but everything else
should result in "permission denied".  Note that you can
do "gmirror status" and "gmirror list" as normal user,
even as user nobody.  It doesn't require any special
privileges, so it works in jails, too.  In fact, you
can get the geom status (in XML format) with the command
"sysctl -b kern.geom.confxml".

Unfortunately there is currently no easy way to suppress
that information.  If you don't want jailed users to be
able to see your geom configuration, you need to modify
the kernel source code.

Best regards
   Oliver

-- 
Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing b. M.
Handelsregister: Registergericht Muenchen, HRA 74606,  Gesch?ftsfuehrung:
secnetix Verwaltungsgesellsch. mbH, Handelsregister: Registergericht M?n-
chen, HRB 125758,  Gesch?ftsf?hrer: Maik Bachmann, Olaf Erb, Ralf Gebhart

FreeBSD-Dienstleistungen, -Produkte und mehr:  http://www.secnetix.de/bsd

"I started using PostgreSQL around a month ago, and the feeling is
similar to the switch from Linux to FreeBSD in '96 -- 'wow!'."
        -- Oddbjorn Steffensen