file descriptor passing (jail related question)

How does file descriptor passing work. From what I can tell it uses the sendmsg and recvmsg calls. Is this only process to process over a non ip socket on the same machine (what's the right terminology for this, just a plain FIFO?), or could one conceivably pass a file descriptor over an ip socket?

I ask, because of jail. If it's just a FIFO, then one can secure fd passing in a jail by controlling who can talk on a socket (since persumably fd passing is used over a pre-existing fd, and there are no pre-existing fd's to outside the jail....)

If it can be transmited over IP, its a much more serious issue, as all one has to do is crack a jail (root inside the jail), crack the local system (regular user) run a program that talks to the local system over ip, and have the cracked regular user pass a fd in.

Any other points to read that I can learn about fd passing would be appreciated as well, as I have never used this feature in my programs, so am somewhat ignorant in regards to it.

thanks,

shaya potter

From: Shaya Potter <[email protected]>
Date: 19 Jul 2002 17:58:07 -0400

How does file descriptor passing work. From what I can tell it uses the sendmsg and recvmsg calls. Is this only process to process over a non ip socket on the same machine (what's the right terminology for this, just a plain FIFO?), or could one conceivably pass a file descriptor over an ip socket?

File descriptors can only be passed over AF_UNIX sockets. These are like fancy FIFO's on the local host using the socket APIs for the communication and synchronization.

thanks, that AF_UNIX bit was what I needed to find it in stevens.

shaya potter

But of course you would have no more access outside the jail than the cracked user. I would expect connections into the jail to behave as if they were on another machine, which would prevent fd passing. At least the last time I played with fd passing it didn't work between machines, that may have been a bug rather than a security features, of course.

bill davidsen <[email protected]>
  CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.