linux-kernel - Re: sys_chroot+sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46F83474.5040503@davidnewall.com>
Date:	Tue, 25 Sep 2007 07:34:36 +0930
From:	David Newall <david@...idnewall.com>
To:	"Serge E. Hallyn" <serge@...lyn.com>
CC:	Bill Davidsen <davidsen@....com>,
	Philipp Marek <philipp@...ek.priv.at>, 7eggert@....de,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	majkls <majkls@...pere.com>, bunk@...tum.de,
	linux-kernel@...r.kernel.org
Subject: Re: sys_chroot+sys_fchdir Fix

Serge E. Hallyn wrote:
> No reason for any new parameters to pivot_root.  Just clone your mounts
> namespace first.
>
> 	unshare(CLONE_NEWNS);
> 	chdir(new_dir);
> 	pivot_root(new_dir, oldroot);
>
> Since pivot_root actually fiddles with the vfsmnts, this is really the
> only way to go about having it "work with just one process".

I think the point is that, whereas we'd like to be able to pivot the 
root for a single process, in practice this causes startup issues to 
which the easy solution is to pivot the whole system.  At least that's 
my reading of the man page.

It might be tidy if pivot_root could be used (instead of a hack based on 
a chroot bug), but it'd still be unportable.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/