lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 20 Mar 2013 06:09:04 -0700
From:	tal.tchwella@...il.com
To:	linux-kernel@...r.kernel.org
Cc:	tchwella@....edu
Subject: [PATCH 0/3] Patches to enable chroot for all users

From: Tal Tchwella <tchwella@....edu>

I want to suggest adding chroot capability to all users.
The following patches enable that capability, while considering the security mechanism needed to disable escape routes for chroots by non-root users,
and keeping chroot backward-compatible for root users.
The first patch establishes the concept of multi-user chroot, while disabling checks for root user in the chroot process.
The second patch checks whether a fd that is sent to a chroot application by a non-root user refers to a directory. 
If that is the case, that fd is skipped, to disable an escape route. 
The third patch disables the option for applications that have open fds to directories to be chrooted by a non-root user.

These patches were applied and test on linux-kernel 3.2.0-31-generic.

Any comments, feedback and suggestions are appreciated!

Thanks,
Tal


Tal Tchwella (3):
  enabled chroot for all users
  socket checks for uds fds transfer
  open fds check when starting chroot

 fs/exec.c             |    3 +++
 fs/open.c             |   32 ++++++++++++++++++++++++++++++--
 include/linux/sched.h |   12 ++++++++++++
 init/main.c           |    1 +
 kernel/fork.c         |    2 ++
 net/core/scm.c        |    9 +++++++++
 6 files changed, 57 insertions(+), 2 deletions(-)

-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists