Re: file descriptor passing (jail related question)

Re: file descriptor passing (jail related question)

[David S. Miller]

   From: Shaya Potter <spotter@cs.columbia.edu>
   Date: 19 Jul 2002 17:58:07 -0400

   How does file descriptor passing work.  From what I can tell it uses the
   sendmsg and recvmsg calls.  Is this only process to process over a non
   ip socket  on the same machine (what's the right terminology for this,
   just a plain FIFO?), or could one conceivably pass a file descriptor
   over an ip socket?
   
File descriptors can only be passed over AF_UNIX sockets.
These are like fancy FIFO's on the local host using the
socket APIs for the communication and synchronization.

file descriptor passing (jail related question)

[Shaya Potter]

How does file descriptor passing work.  From what I can tell it uses the
sendmsg and recvmsg calls.  Is this only process to process over a non
ip socket  on the same machine (what's the right terminology for this,
just a plain FIFO?), or could one conceivably pass a file descriptor
over an ip socket?

I ask, because of jail.  If it's just a FIFO, then one can secure fd
passing in a jail by controlling who can talk on a socket (since
persumably fd passing is used over a pre-existing fd, and there are no
pre-existing fd's to outside the jail....)

If it can be transmited over IP, its a much more serious issue, as all
one has to do is crack a jail (root inside the jail), crack the local
system (regular user) run a program that talks to the local system over
ip, and have the cracked regular user pass a fd in.

Any other points to read that I can learn about fd passing would be
appreciated as well, as I have never used this feature in my programs,
so am somewhat ignorant in regards to it.

thanks,

shaya potter

Re: file descriptor passing (jail related question)

[Shaya Potter]

thanks, that AF_UNIX bit was what I needed to find it in stevens.

shaya potter

On Fri, 2002-07-19 at 17:53, David S. Miller wrote:
> 
>    From: Shaya Potter <spotter@cs.columbia.edu>
>    Date: 19 Jul 2002 17:58:07 -0400
> 
>    How does file descriptor passing work.  From what I can tell it uses the
>    sendmsg and recvmsg calls.  Is this only process to process over a non
>    ip socket  on the same machine (what's the right terminology for this,
>    just a plain FIFO?), or could one conceivably pass a file descriptor
>    over an ip socket?
>    
> File descriptors can only be passed over AF_UNIX sockets.
> These are like fancy FIFO's on the local host using the
> socket APIs for the communication and synchronization.

Re: file descriptor passing (jail related question)

[Bill Davidsen]

On 19 Jul 2002, Shaya Potter wrote:

> If it can be transmited over IP, its a much more serious issue, as all
> one has to do is crack a jail (root inside the jail), crack the local
> system (regular user) run a program that talks to the local system over
> ip, and have the cracked regular user pass a fd in.

But of course you would have no more access outside the jail than the
cracked user. I would expect connections into the jail to behave as if
they were on another machine, which would prevent fd passing. At least the
last time I played with fd passing it didn't work between machines, that
may have been a bug rather than a security features, of course.

-- 
bill davidsen <davidsen@tmr.com>
  CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.