lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20070925153208.GO6800@stusta.de>
Date:	Tue, 25 Sep 2007 17:32:08 +0200
From:	Adrian Bunk <bunk@...nel.org>
To:	David Newall <david@...idnewall.com>
Cc:	"Serge E. Hallyn" <serge@...lyn.com>,
	Bill Davidsen <davidsen@....com>,
	Philipp Marek <philipp@...ek.priv.at>, 7eggert@....de,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	majkls <majkls@...pere.com>, linux-kernel@...r.kernel.org
Subject: Re: Chroot bug (was: sys_chroot+sys_fchdir Fix)

On Wed, Sep 26, 2007 at 12:40:27AM +0930, David Newall wrote:

> Miloslav Semler pointed out that a root process can chdir("..") out of its 
> chroot.  Although this is documented in the man page, it conflicts with the 
> essential function, which is to change the root directory of the process.  
> In addition to any creative uses, for example Philipp Marek's loading 
> dynamic libraries, it seems clear that the prime purpose of chroot is to 
> aid security.  Being able to cd your way out is handy for the bad guys, but 
> the good guys don't need it; there are a thousand better, safer solutions.
>...

The bad guys most likely also now other tricks to escape the chroot.

If you are root in the chroot you can e.g. mount the partition with the 
root filesystem inside the chroot.

If a bad guy becomes root inside a chroot it's game over.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ