Re: Linux 2.2.18pre21

Alan Cox
2000-11-16T22:10:11Z

> It's simply not good enough to close all directory file descriptors before chrooting.
>
> If calling chroot once you're already in a chroot jail was disallowed, it would stop
> this attack.

I think the problem here is that some people have the idea that chroot is
some kind of magical security device. Thats not true at all. You can build an
environment like that if you wish by closing other directory handles and having
no suitably priviledged code in the chroot area and stuff.

Alan