lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 2 Oct 2022 00:11:50 +0100
From:   Al Viro <>
To:     David Laight <>
Cc:     "'Eric W. Biederman'" <>,
        Linus Torvalds <>,
        "" <>,
        "" <>,
        "Serge E. Hallyn" <>
Subject: Re: [CFT][PATCH] proc: Update /proc/net to point at the accessing
 threads network namespace

On Fri, Sep 30, 2022 at 09:28:31PM +0000, David Laight wrote:
> > > FWIW I'm pretty sure there a sequence involving unshare() that
> > > can get you out of a chroot - but I've not found it yet.
> > 
> > Out of a chroot is essentially just:
> > 	chdir("/");
> >         chroot("/somedir");
> >         chdir("../../../../../../../../../../../../../../../..");
> A chdir() inside a chroot anchors at the base of the chroot.
> fchdir() will get you out if you have an open fd to a directory
> outside the chroot.
> The 'usual' way out requires a process outside the chroot to
> just use mvdir().
> But there isn't supposed to be a way to get out.

In order of original claims:

* chdir inside a chroot does *NOT* "anchor at the base of the chroot".
What it does is (a) start at the base if the pathname is absolute and
(b) treats .. in the base as ., same as any other syscall.

* correct.

* WTF is "mvdir()"?  Some Unices used to have mvdir(1), but it had never
been a function...  And mv(1) (or rename(2)) is far from being the only
way for assistant outside of jail to let the chrooted process out.

* ability to chroot(2) had always been equivalent to ability to undo
chroot(2).  If you want to prevent getting out of there, you need
(among other things) to prevent the processes to be confined from
further chroot(2).

Powered by blists - more mailing lists