Re: Chroot bug

From: Miloslav Semler
Date: Tue Sep 25 2007 - 13:00:44 EST

This does not help. Let's try:
chroot somewhere
mkdir foo
fd = open /
chroot foo

('fd' implicitly closed and chdir to /foo)
Really? Try it. I am sure, that this works. You can create directory in chroot and break chroot by this. fd is not closed, because linux doesn't close descriptors by chroot syscall. this can be done every time if you have CAP_SYS_CHROOT.
fchdir fd


chdir ".."

/../ => /

chdir ".."
chroot "."
so you are in root.

so we remain in chroot.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at