Messages in this thread | | | Subject | Re: prevent breaking a chroot() jail? | Date | Fri, 5 Jul 2002 22:35:06 +0100 (BST) | From | Alan Cox <> |
| |
> work (most likely only for a subset of processes, i.e. processes that > are run in the jail end up getting a marker which is passed down to all > their children that causes the syscalls to behave differently). > > What should I be aware of? I figure devices (no need to run mknod in > this jail) and chroot (as per man page), is there any other way of > breaking the chroot jail (at a syscall level or otherwise)? > > or is this 100% impossible?
Its hairy. You need to avoid devices, root, fd passing from untrusted agents outside the chroot world and shared uid (ptrace) attacks. If you are outside the USA you can do this with NSA SE Linux although in the US you may hit the type enforcement patents.
Alan - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |