4 ms·
Just to make sure I understand what's happening here: 1) a direct chroot("../../../") would not work, as the kernel restricts ../ to / if at the chroot-root.
by davrosthedalek 7y ago
Just to make sure I understand what's happening here:
1) a direct chroot("../../../") would not work, as the kernel restricts ../ to / if at the chroot-root.
2) chroots are not nested.
3) By making a handle to a path, then chrooting, the security measure 1) is disabled for that handle (as it's outside of the current chroot), and the kernel doesn't keep track that it was created in an earlier chroot.
Is that right?
- cyphar 7y ago(1) is mostly right. The actual restriction is that ".." will be a no-op if the current directory is equal to nd->root (what your current root is). (2) Yes, each process only has one root at a time. (3) The restrictions don't apply to file handles at all (an fd doesn't know what chroot it was created in). Instead what happens is that the restriction in (1) is useless once the current directory of the resolution is above the nd->root (after all, a directory above nd->root is not equal to nd->root).
- davrosthedalek 7y agoAh, thanks I think I got it now. That's indeed trivial to execute as long as one still can do chroot.