Messages in this thread | | | Date | Wed, 07 Dec 2011 12:34:28 -0800 | From | "H. Peter Anvin" <> | Subject | Re: chroot(2) and bind mounts as non-root |
| |
On 12/07/2011 09:54 AM, Colin Walters wrote: > > The historical reason one can't call chroot(2) as non-root is because of > setuid binaries (hard link a setuid binary into chroot of your choice > with trojaned libc.so).
No. The historical reason is that it lets anyone escape a chroot jail:
mkdir("jailbreak", 0666); chroot("jailbreak");
/* Now the cwd is outside the root, and therefore not bound by it, walk the chain of .. directories until they don't change anymore */
chroot("."); /* Change the root to the system root */
Oops.
-hpa
| |