linux-kernel - Re: pivot_root alternative

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 24 Jun 2007 19:29:20 -0400
From:	Kyle Moffett <mrmacman_g4@....com>
To:	Salvatore De Paolis <depaolis.salvatore@...ero.it>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Jan Engelhardt <jengelh@...putergmbh.de>,
	Arnd Hannemann <arnd@...dnet.de>
Subject: Re: pivot_root alternative

On Jun 24, 2007, at 17:27:34, Salvatore De Paolis wrote:
> i built the kernel with a busybox initramfs which runs from a usb  
> stick. While i boot i need to mount the real root and i'm using  
> pivot_root.  Pivot_root . old-root return to me an "Invalid  
> argument" error and googling i found here http://lkml.org/lkml/ 
> 2005/10/8/17 that pivot_root should be avoided.  I want to ask now  
> what i should do to switch to a real root?

One interesting fact about the mount() syscall is this: when  
overmounting a directory tree, a process whose current working  
directory is within said directory tree will see the old vfsmounts  
until it does an absolute chdir().  Shells tend not to be terribly  
useful for this because they use absolute paths more than necessary,  
but I think you can make it work.  For instance, if you run these  
commands after mounting the root filesystem:

mount -t proc proc /realroot/proc
cd /
mount --move /realroot /
find /proc/$$/cwd/ -mindepth 1 -maxdepth 1 -print0 \
		| xargs -0 rm -rf -- '{}' ';'
cd /

This will set up proc on the new root filesystem, move /realroot to  
the root directory, and delete the contents of the old initramfs  
using the old current-working-directory link of your shell.  The  
amusing thing is that you are using the "find" and "rm" commands from  
the newly mounted root filesystem to remove the contents of the  
completely hidden initramfs.  The only reason it's actually possible  
is because you have the tenuous thread of the working directory.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/