lkml.org 
[lkml]   [1998]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Security patch for /proc
Savochkin Andrey Vladimirovich wrote:
>
> IMHO you overload the kernel.
> A non-root process can't escape from the chroot jail if no
> processes with the same owner are run in the origin root.

That's not something which can always be assumed. Other Unix systems
don't have /proc and don't make this requirement of someone using
chroot. It can be assumed that once a non-root process is in a chrooted
jail, it cannot escape, even if there's processes with different roots
and the same uid.

This is weakened by Linux's /proc, since they can escape. You can play
with uids to prevent this, but its a Linux-specific weakness you're
working around, and there's no guarentee that all software will make the
effort.

J

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.039 / U:0.620 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site