Messages in this thread | | | Date | Wed, 6 Aug 2003 13:08:14 +0200 | From | Herbert Pötzl <> | Subject | Re: chroot() breaks syslog() ? |
| |
On Wed, Aug 06, 2003 at 10:42:40AM +0200, Oliver Pitzeier wrote: > > > IMHO, devfs in chroot environment, is defeating the purpose > > > because if you have access to raw devices, like the device > > > your chroot dir is on, > > > you can easily mount that device again, and voila you have > > > access to > > > the full tree, if you > > > > You need to be root to mount the device, and as root you can > > also create the device special file. A chroot environment > > does not reliably guard against root breaking out of it. > > That's not completly wrong nor is it completly true. :) > > You _CAN_ guard yourself from root's breaking out of some chroot environment. > Using grsec (www.grsecurity.net). Denying double-chroots, creation of special > files within chroot-environments and if you like it... Deny mounting within > chroot. :)
hmm, how will you avoid creation of special (devicenodes) files if I have raw access to any partition? I can 'simply' use xxd to create my special inodes on the medium ... and I would not care if mount is enabled or not when I wipe the root partition with dd ...
best, Herbert
> There are many options provided - just use 'em. :) > > Best regards, > Oliver - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |