freebsd security - Dec 2013 - [PATCH RFC] Disable save-entropy in jails

Hi,

I think we shouldn't save entropy inside jails, as the data is not going
to be used by rc script (pjd at 126744).  If there is no objections, I will
commit this changeset on January 1, 2014.

Index: libexec/save-entropy/save-entropy.sh
==================================================================---
libexec/save-entropy/save-entropy.sh	(revision 259828)
+++ libexec/save-entropy/save-entropy.sh	(working copy)
@@ -42,6 +42,10 @@ elif [ -r /etc/rc.conf ]; then
 	. /etc/rc.conf 2>/dev/null
 fi

+if [ `/sbin/sysctl -n security.jail.jailed` -eq 1 ]; then
+	exit 0
+fi
+
 case ${entropy_dir} in
 [Nn][Oo])
 	exit 0

Cheers,
-- 
Xin LI <delphij at delphij.net>    https://www.delphij.net/
FreeBSD - The Power to Serve!           Live free or die

On Dec 24, 2013, at 12:44 PM, Xin Li <delphij at delphij.net> wrote:
> I think we shouldn't save entropy inside jails, as the data is not
going
> to be used by rc script (pjd at 126744).  If there is no objections, I will
> commit this changeset on January 1, 2014.
Even if it is not used by an rc script, it might be used by some userland
program (running as root, of course) that knows about the directory and wants
some fresh entropy for its own use.

Is there a problem with saving the directory in jails? It certainly isn't
taking up much space.

--Paul Hoffman

On Tue, Dec 24, 2013 at 12:44:34PM -0800, Xin Li wrote:
> Hi,
> 
> I think we shouldn't save entropy inside jails, as the data is not
going
> to be used by rc script (pjd at 126744).  If there is no objections, I will
> commit this changeset on January 1, 2014.
I agree we shouldn't do it. I have this line in my crontab that I wanted
to commit at some point:

1,31    0-5     *       *       *       root    [ `sysctl -n
security.jail.jailed` -eq 0 ] && adjkerntz -a

It prevents executing adjkerntz from within a jail, but allows to keep
the same crontab in and outside jails.

We could do the same for save-entropy. It would be even nicer to have
some flag so that even sysctl(8) is not executed.
> Index: libexec/save-entropy/save-entropy.sh
> ==================================================================> ---
libexec/save-entropy/save-entropy.sh	(revision 259828)
> +++ libexec/save-entropy/save-entropy.sh	(working copy)
> @@ -42,6 +42,10 @@ elif [ -r /etc/rc.conf ]; then
>  	. /etc/rc.conf 2>/dev/null
>  fi
> 
> +if [ `/sbin/sysctl -n security.jail.jailed` -eq 1 ]; then
> +	exit 0
> +fi
> +
>  case ${entropy_dir} in
>  [Nn][Oo])
>  	exit 0
-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://mobter.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL:
<http://lists.freebsd.org/pipermail/freebsd-security/attachments/20131225/ae3eb0b1/attachment.sig>