Check paths for security:

 path must be absolute.
 mount paths must exist and have no symlinks beyond the jail's path itself.
 consolelog must exist (apart from the final component) and have no
  symlinks beyond the jail's path itself.

1 files changed, 6 insertions, 0 deletions

diff --git a/usr.sbin/jail/jail.c b/usr.sbin/jail/jail.c
index 0bc1bd1..dd1b92c 100644
--- a/usr.sbin/jail/jail.c
+++ b/usr.sbin/jail/jail.c
@@ -659,6 +659,12 @@ create_jail(struct cfjail *j)
 	 * gives.
 	 */
 	if ((path = string_param(j->intparams[KP_PATH]))) {
+		if (path[0] != '/') {
+			jail_warnx(j, "path %s: not an absolute pathname",
+			    path);
+			failed(j);
+			return -1;
+		}
 		if (stat(path, &st) < 0) {
 			jail_warnx(j, "path %s: %s", path, strerror(errno));
 			failed(j);