jails Conflict on TUN interfaces between different jails

I have two separate jails that are not visible to each other. There is no sharing of tun* interfaces in the devfs.rules. However, when I create the tun0 interface in Jail 1, I encounter difficulties creating the same interface, tun0, in Jail 2. Upon attempting, I receive a message indicating that the interface already exists. Interestingly, when attempting to remove the interface, the system states that it does not exist. This suggests that the tun0 interface from Jail 1 is being detected in Jail 2, even without explicit sharing.

To replicate this issue:
  1. Create two jails, jailA and jailB.
  2. Do not allow the sharing of tun* in /etc/defaults/devfs.rules.
  3. Run the following commands:
  4. jexec jailA ifconfig tun0 create
    jexec jailB ifconfig tun0 create
  5. You will receive an error stating that the interface already exists. Try to delete the interface, and you will get an error saying that it doesn't exist.

This behavior indicates a potential issue where the tun0 interface created in JailA is being detected in JailB, despite the absence of explicit sharing. Understanding the root cause of this behavior can help determine if it is a bug or if there is a logical explanation for this interaction between the jails.
 
The reason this happens is because jails share the kernel with the host, and so there is a /dev/tun0 device on the host. jailB doesn't have direct access to or knowledge of jailA's interface - but it can infer the presence of a device named /dev/tun0 being managed by the kernel.

This was discussed in a recent jail user's call, where the idea of an enumeration attack was presented:

View: https://www.youtube.com/watch?v=OWRcZmErihU&t=2592s
 
Back
Top