Re: Chroot bug

[Miloslav Semler]

> > This  does not help.  Let's try:
> > chroot somewhere
> > mkdir foo
> > fd = open /
> > chroot foo
> >     
>
> ('fd' implicitly closed and chdir to /foo)
>   
Really? Try it. I am sure, that this works. You can create directory in 
chroot and break chroot by this. fd is not closed, because linux doesn't 
close descriptors by chroot syscall. this can be done every time if you 
have CAP_SYS_CHROOT.
>   
> > fchdir fd
> >     
>
> -EINVAL
>
>   
> > chdir ".."
> >     
>
> /../ => /
>
>   
> > ....
> > chdir ".."
> > chroot "."
> > so you are in root.
> >     
>
> so we remain in chroot.
>   

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/