3 ms·
The "chroots doesn't offer any security" statement needs to be a bit more nuanced. A non-privileged process in a dedicated directory can't do much damage, and c
by xorcist 7y ago
The "chroots doesn't offer any security" statement needs to be a bit more nuanced. A non-privileged process in a dedicated directory can't do much damage, and certainly can't escape the chroot without some sort of privilege escalation.
That does not mean you can slap chroot syscalls everywhere and call it secure, of course. But it is still an important part of dropping privileges, together with seccomp-bpf, control groups and the various ACL systems.
It is an important part of things like the OpenSSH privilege separation, where the early protocol is handled by a dedicated process in a read only chroot. It proven both simple and effective in practice, contrary to the idea that chroots are escapable.
- viraptor 7y agoHere's a list of ways to break out, marked either as root required or not. Some are only vague idea, others are explained. https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20O... I too thought you can't easily escape unprivileged chroot, but in reality you need to think about quite a few things to make sure it's true. And once you need to think about those things... Why not apparmor/selinux instead.
- xorcist 7y agoNone of the listed methods are novel. Most are elaborate ways of saying "privilege escalation". If an untrusted process can escalate to root, ptrace to unrelated processes, or access memory outside your process, it was never really contained in the first place. Do also note that none of the listed methods works in what the presentation itself calls a "reasonable chroot". > Why not apparmor/selinux instead It's not either or. Dropping privileges is something you preferably do in more ways than one.