Re: Chroot bug

From: Miloslav Semler
Date: Tue Sep 25 2007 - 13:09:33 EST

Jan Engelhardt napsal(a):
On Sep 25 2007 19:00, Miloslav Semler wrote:
This does not help. Let's try:
chroot somewhere
mkdir foo
fd = open /
chroot foo
('fd' implicitly closed and chdir to /foo)
Really? Try it. I am sure, that this works. You can create directory in chroot
and break chroot by this. fd is not closed, because linux doesn't close
descriptors by chroot syscall. this can be done every time if you have

In case you have not followed my earlier email, I'll repost:

|>> So what? Just do this: chdir into the root after chroot.
|> I don't think so. His exploit just got me all the way out of a |> chroot within a chroot within a chroot, inclusive of lots of |> chdirs.
|Close all fds that point to directories outside the root ;-)

Perhaps that was formulated a bit sloppy. It of course means
"On chroot(2), implicitly close all FDs that point outside."
yes, but I can use fds from chroot ;-) ....
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at