lkml.org 
[lkml]   [1998]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Chroot breach in 2.1.100+
-----BEGIN PGP SIGNED MESSAGE-----

assuming that you are smart enough to not give a process in a chroot box a
file handle outside that box when you start it, is it still trivial to
break out (as root) or is it now much more difficult?

along the same lines, is it possible to chroot in a way that also changes
the uid that the chrooted process is running under?

David Lang


On Mon, 21 Sep 1998, Marc Slemko wrote:

> Date: Mon, 21 Sep 1998 01:53:57 -0700 (PDT)
> From: Marc Slemko <marcs@go2net.com>
> To: linux-kernel@vger.rutgers.edu
> Subject: Re: Chroot breach in 2.1.100+
>
> On Sun, 20 Sep 1998, David S. Miller wrote:
>
> > Date: Sun, 20 Sep 1998 18:32:01 -0400 (EDT)
> > From: Alexander Viro <viro@math.psu.edu>
> >
> > # mount -t proc none .
> > # echo ./../*
> > <contents of the _parent_ of foo>
> >
> > If you're root and can mount filesystems, you lose anyways.
> >
> > Consider open("./1/cwd"...); open("./25/fd/5"...); etc.
>
> Even if you can't mount filesystems you lose anyway with the standard
> fd = open(".", ...); chroot("somedir"); fchdir(fd); chdir("..") a number
> of times; chroot(".").
>
> ie. you can chroot again, while keeping a handle open to a directory
> outside your new chroot, then use that to walk up and chroot to the real
> '/'.
>
> Many of the cases you come across can be fixed by various "oh, just deny
> this", but chroot() was never designed to be unbreakable by root with
> access to execute either arbitrary code or a reasonable set of basic
> utilities. It isn't on Linux, and it isn't on near any other machine.
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQEVAwUBNgaXnD7msCGEppcbAQHFDwgAsNAuokm5/ZNwKdUXLiWenEsfi3ys0yax
Dvplt0rxbJU1G7U0wVZJwIApgqNZt6i2Zz8JmPQOkx17ufaDVS7liiE6JjvPVB9f
HDvwarJHcIEHFUBELmzgmS65u1glApWX1KKtdWQke7bDWoLVXeEC+NXGY2HCZ+HK
yP0HIRuJqrMOnLYH4VplDZSXqDvs+8NRvJPdLebsUHidarTuqQIl2pRvqqfEhyEk
NJmpe9Pt3tGG/PnG5k3JDcdt7mJpd6dlEqmBGUwamG4AHEAaxfR22awZfzmOdhvJ
mhPP/fj+qX9UdQcpXiKwruUpirn0AmNOQcUGn9AKdm9FNntU2ARW8w==
=s5aQ
-----END PGP SIGNATURE-----


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.070 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site