[lkml]   [2012]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 4/4] Allow unprivileged chroot when safe
    On Sun, 2012-01-15 at 16:37 -0800, Andy Lutomirski wrote:

    > Because chroot is an easy way to break out of chroot jail, CAP_SYS_ADMIN
    > is still required if the caller is already chrooted.

    This part is pretty gross. It means it won't work for stuff like
    containers (systemd-nspawn etc.) and furthermore I have plans that
    involve running OS trees inside a chroot, and this would obviously not
    work for that.

    Incidentally I ended up putting my setuid program here:

    Now unfortunately, even if we say that a new setuid program is the way
    to gain these privileges, you still can't nest it, because all of these
    things are predicated on disabling setuid programs. But it would at
    least not fail initially if your process was inside a chroot.

     \ /
      Last update: 2012-01-16 20:29    [W:0.027 / U:83.672 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site