Jan Engelhardt napsal(a):
On Sep 25 2007 19:00, Miloslav Semler wrote:This does not help. Let's try: chroot somewhere mkdir foo fd = open / chroot foo('fd' implicitly closed and chdir to /foo)Really? Try it. I am sure, that this works. You can create directory in chroot and break chroot by this. fd is not closed, because linux doesn't close descriptors by chroot syscall. this can be done every time if you have CAP_SYS_CHROOT.In case you have not followed my earlier email, I'll repost: |>> So what? Just do this: chdir into the root after chroot. |>|> I don't think so. His exploit just got me all the way out of a |> chroot within a chroot within a chroot, inclusive of lots of |> chdirs.|> | |Close all fds that point to directories outside the root ;-) Perhaps that was formulated a bit sloppy. It of course means "On chroot(2), implicitly close all FDs that point outside."
yes, but I can use fds from chroot ;-) .... - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
- References:
- Re: sys_chroot+sys_fchdir Fix
- From: "Philipp Marek" <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: Philipp Marek <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: Bill Davidsen <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: "Serge E. Hallyn" <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: "Serge E. Hallyn" <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: "Serge E. Hallyn" <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- From: David Newall <[email protected]>
- Chroot bug (was: sys_chroot+sys_fchdir Fix)
- From: David Newall <[email protected]>
- Re: Chroot bug (was: sys_chroot+sys_fchdir Fix)
- From: Jan Engelhardt <[email protected]>
- Re: Chroot bug
- From: David Newall <[email protected]>
- Re: Chroot bug
- From: Jan Engelhardt <[email protected]>
- Re: Chroot bug
- From: Miloslav Semler <[email protected]>
- Re: Chroot bug
- From: Jan Engelhardt <[email protected]>
- Re: Chroot bug
- From: Miloslav Semler <[email protected]>
- Re: Chroot bug
- From: Jan Engelhardt <[email protected]>
- Re: sys_chroot+sys_fchdir Fix
- Prev by Date: Re: [PATCH 1/1] Kernel compile bug in 2.6.22.6/7 {maybe more} ARM/StrongARM
- Next by Date: Re: Chroot bug
- Previous by thread: Re: Chroot bug
- Next by thread: Re: Chroot bug
- Index(es):
 |