What are the security implications of using allow.sysvipc in a FreeBSD jail
So, it turns out that the extreme interpretation is correct. Allowing sysvipc "... defeat[s] the whole purpose of having a jail; privileged users from the jail would be able to affect processes outside the jailed environment."
UPDATE Aug 3, 2010: After some serendipitous research, I've been able to flesh out some details. The problem stems from the fact that process permissions are based on UIDs (note that this means the number, not the string identifier). So, even though the user spaces for the host and jail are mutually separate, this division isn't iron-clad and given that root has a UID of 0, we get the quote above. Some options to minimize the risk:
- Ensure all users across the entire system (host and jails) have different UIDs
- Disable root login for the jails (won't help with processes run as root so sudo tricks but some is better than none.)