For almost a year, my jailexec connection plugin let a compromised FreeBSD jail redirect a root-owned write onto the jail host. The input validation was fine. The problem was on which side of the j...

At the end of last year I wrote about jailexec, my Ansible connection plugin that manages FreeBSD jails by SSHing to the jail host and running everything through jexec. That article has a section called Security Design. It proudly explains the two-stage file transfer: upload to a temporary location on the host, then move it into the jail with privilege escalation.

    • LostWanderer@fedia.io
      1·
      1 month ago

      Yeah, whenever I see an AI slop picture and a blog link…I just downvote and refuse to read. If they used a generative AI to create a slop image, who know if the words themselves were written by a person!