Screen is launched from jailbash.

In terms of your comment re: “AppArmor here is silly” I guess that is a matter op opinion and how you feel about security. I use this shared session to demo apparmor.

In terms of a “terrible flaw in this procedure”, I wonder if you are not understanding how apparmor works.

Small snippets of code, all run as root, in the screen session:


root@ufbt:~#echo $SHELL
/bin/bash
root@ufbt:~#id
uid=0(root) gid=0(root) groups=0(root)
root@ufbt:~#cp ~guru/.bashrc ~.gugu.bashrc.bak
root@ufbt:~#rm ~guru/.bashrc.bak
rm: cannot remove `/home/guru/.bashrc.bak': No such file or directory
root@ufbt:~#rm -rf ~guru/.bashrc
rm: cannot remove `/home/guru/.bashrc': Permission denied
root@ufbt:~#echo "test" >> ~guru/.bashrc
-bash: /home/guru/.bashrc: Permission denied

As you can see, apparmor is working perfectly and as expected, in screen, even when switching to root and starting a new bash shell.

I use this as I allow members of the Ubuntu Forums Beginners Team to use the screen session for teaching. guest access is available to anyone and everyone.

Your choices may vary, and that is fine, but I hope this little demo has alleviated your concerns.

If you would like to try to crack the system you are free to try it out.

When a client logins via ssh the execution sequence is as follows:
1. sshd invokes shell with arguments “sh -c /usr/local/bin/jailbash”
2. sh now reads users configuration files (flaw is here)
3. jailbash should be run – this is after the config files are fully executed

Now, just take a look what we did in step 2 – invoke screen – this stops our sequence, so number 3 is not executed in proper place. Conclusion – screen is not run from jailbash but from usuall shell. This can be seen on server with ‘ps A f’ – parent of screen is sh not jailbash. This could be overcome with SHLEVEL but I don’t like that idea.

Either way, using AppArmor here is silly, since the sh shell has to be executed I propose to invoke a script which in turn uses ‘exec’ command with screen so there is no shell to return to.

Salut my linux friends!