fix(security): getAllJails infinite loop, stack sh -c injection + traversal, gui /tmp symlink, safePath prefix bug, socket_proxy confinement (1.1.25)

[click0]

Summary

Five fixes from a third-pass audit of the modules no earlier pass had covered (GUI/session, VM stack, lifecycle/runtime, audit/util/parsers). Everything here ships without FreeBSD hardware — pure parts are unit-tested, runtime parts are compile-gated by the FreeBSD lite build.

1. Infinite loop in getAllJails(crateOnly=true) — lib/jail_query.cpp (HIGH, DoS)

The lastjid cursor advance sat after the crateOnly filter, so a non-crate jail hit continue without moving the cursor and the next jailparam_get returned the very same jail forever — 100% CPU the moment any foreign jail (bastille/pot/plain jail(8)) coexisted with crate. That wedged every crateOnly caller — crate top/clean/doctor/info/list/console/stack — and the crated control-socket jail listing. No attacker input needed. The cursor now advances before the filter.

2. Command injection into a root sh -c via stack-file fields — lib/stack.cpp (HIGH)

Container name, its static IP, and a network's gateway were interpolated unescaped into printf '…' >> /etc/hosts / printf 'nameserver …' > /etc/resolv.conf fragments stored in run:before-start-services and executed by /bin/sh -c as root. A container keyed x';touch /tmp/pwned;' ran arbitrary commands as root on crate stack up. New StackPure::validateStackName ([A-Za-z0-9._-], ≤64, no leading -) and validateStackIp (charset-gated inet_pton, CIDR tolerated) are applied at parse time and re-applied as a sink-guard right where each value enters the shell string.

3. Path traversal via stack network name → root write + delete — lib/stack.cpp (HIGH)

confDir = dnsBaseDir()/dns-<network.name> was create_directories'd, written, passed to unbound -c, and remove_all'd as root with an unvalidated YAML key. ../../../etc/cron.d let root write under an attacker-chosen path and recursively delete an attacker-chosen tree. Closed by the same validateStackName (no /, no ..).

4. Predictable /tmp screenshot files → symlink attack — lib/gui.cpp (HIGH when root)

/tmp/crate-screenshot-<displayNum>.{ppm,xwd} (displayNum guessable, starts at 10) opened via fopen/xwd -out with no O_EXCL/O_NOFOLLOW; gui screenshot runs with root's EUID, so a local user could pre-plant a symlink and have root overwrite an arbitrary file (CWE-59). Scratch files now live in a private mkdtemp(3) dir (0700, random name) removed on every exit path.

5. Util::safePath over-rejected every path when the prefix ends in / — lib/util_pure.cpp (MED)

The separator check demanded canonical[prefix.size()] == '/', but a prefix that already ends in / (root "/" is the degenerate case) has consumed that separator, so the check always failed → socketProxy.share aborted on every real path. Separator now demanded only when the prefix doesn't supply it.

6. socketProxy jail-side confinement — lib/run_services.cpp (closes deferred TODO item)

With safePath fixed, the share loop's safePath(sock, "/", …) would pass everything (prefix / can't confine; return discarded while the raw .. path still reached J()), and proxy had no guard at all. Both now validate the concatenated jail-side path stays under jailPath — the same guard run.cpp uses for dirsShare. (proxy.host is the operator's host-side target, deliberately not jail-confined.)

Tests

• stack_test: name/IP injection + traversal rejected, clean values accepted (a..b single component OK, 10.0.0.5/24 CIDR tolerated).
• util_security_test: root prefix accepts absolute paths; trailing-slash prefix still rejects siblings.
• Both pass locally. jail_query/gui/run_services are runtime-only → FreeBSD lite compile gate.

Also noted (not changed)

lib/vm_spec.cpp / vm_run.cpp / vm_stack.cpp carry libvirt-XML injection + traversal sinks (vmName, vol.tag, disk, sharedBridge) that would be HIGH if reachable — but createVm/parseVmOptions/generateDomainXml have no callers. Recorded in TODO to harden before that code is wired up. Remaining deferred: the network_lease flock race (needs a real multi-process test on FreeBSD).

Version

Bumps to 1.1.25; CHANGELOG.md + docs/trust-model.{md,uk.md} updated.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X6t6tzVypHye5bDGLxzmZK

---

Generated by Claude Code