lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 2 Oct 2022 00:11:50 +0100 From: Al Viro <viro@...iv.linux.org.uk> To: David Laight <David.Laight@...lab.com> Cc: "'Eric W. Biederman'" <ebiederm@...ssion.com>, Linus Torvalds <torvalds@...ux-foundation.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "Serge E. Hallyn" <serge@...lyn.com> Subject: Re: [CFT][PATCH] proc: Update /proc/net to point at the accessing threads network namespace On Fri, Sep 30, 2022 at 09:28:31PM +0000, David Laight wrote: > > > FWIW I'm pretty sure there a sequence involving unshare() that > > > can get you out of a chroot - but I've not found it yet. > > > > Out of a chroot is essentially just: > > chdir("/"); > > chroot("/somedir"); > > chdir("../../../../../../../../../../../../../../../.."); > > A chdir() inside a chroot anchors at the base of the chroot. > fchdir() will get you out if you have an open fd to a directory > outside the chroot. > The 'usual' way out requires a process outside the chroot to > just use mvdir(). > But there isn't supposed to be a way to get out. In order of original claims: * chdir inside a chroot does *NOT* "anchor at the base of the chroot". What it does is (a) start at the base if the pathname is absolute and (b) treats .. in the base as ., same as any other syscall. * correct. * WTF is "mvdir()"? Some Unices used to have mvdir(1), but it had never been a function... And mv(1) (or rename(2)) is far from being the only way for assistant outside of jail to let the chrooted process out. * ability to chroot(2) had always been equivalent to ability to undo chroot(2). If you want to prevent getting out of there, you need (among other things) to prevent the processes to be confined from further chroot(2).
Powered by blists - more mailing lists