lkml.org 
[lkml]   [2002]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: can chroot be made safe for non-root?
    Date
    Philippe Troin  wrote:
    >Eric Buddington <eric@ma-northadams1b-3.bur.adelphia.net> writes:
    >> Would it be reasonable to allow non-root processes to chroot(), if the
    >> chroot syscall also changed the cwd for non-root processes?
    >
    >No.
    >
    > fd = open("/", O_RDONLY);
    > chroot("/tmp");
    > fchdir(fd);
    >
    >and you're out of the chroot.

    Irrelevant. If a process *wants* to voluntarily sandbox itself, it can
    close all open file descriptors before sandboxing.

    Please note that
    chroot("/tmp");
    fd = open("/", O_RDONLY);
    fchdir(fd);
    does *not* let you escape from the sandbox. This means that a process
    can sandbox itself, and once sandboxed, it can no longer escape.
    This functionality would be very useful for security purposes (see, e.g.,
    "privilege separation").

    It is true that there are some tricky issues here. For instance, root
    has many ways to escape from a chroot() jail, so you should never use
    chroot() to confine processes running as root. Also, if non-root users
    can call chroot(), then there may be bad interactions if the chroot-ed
    process later calls chroot() again, or execs a setuid program.

    However, I believe all of these tricky issues can be dealt with. See, e.g.,
    http://www.cs.berkeley.edu/~smcpeak/cs261/index.html
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:0.022 / U:0.308 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site