Messages in this thread | | | Date | Sun, 30 May 1999 22:09:44 -0400 (EDT) | From | "Theodore Y. Ts'o" <> | Subject | Re: access to proc filesystem from chrooted process |
| |
Date: Fri, 28 May 1999 10:13:59 -0700 (PDT) From: Tim Smith <tzs@tzs.net>
Check the archives of this list. A while back there was a discussion of chroot, and many ways to get out of a chroot'ed environment were listed. I seem to recall that the conclusion was that chroot is not meant to be, and cannot be made into, a secure environment. It is really just a safety net that will catch accidental goofs, but won't stop anyone trying to get around it.
I wouldn't go that far. It's possible to use chroot as part of secure, restricted environment. However, there are other restrictions that a process which is setting up such a restricted environment really does have to check for in order to assure that the environment really is secure. For example, the parent process which is doing the chroot needs to make sure that there aren't any excess open file descriptors; it needs to make sure there aren't any stray extra devices present in the enviroment. There had better not be any setuid root programs in the chroot'ed part of the filesystem, and the chrooted process should not have root privileges when the environment is setup, and so on.
It's true that chroot is a general purpose solution where you don't have to pay attention to other issues. But there are very few such examples in the security world. The devil is always in the details, no matter which tools you are using --- and chroot is simply one such tool, with strengths and limitations.
- Ted
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |