Re: sys_chroot+sys_fchdir Fix

From: Christer Weinigel
Date: Wed Sep 26 2007 - 15:32:21 EST

On Wed, 26 Sep 2007 20:04:14 +0930
David Newall <david@xxxxxxxxxxxxxxx> wrote:

> Al Viro wrote:
> > Oh, for fsck sake... Folks, it's standard-required behaviour.
> > Ability to chroot() implies the ability to break out of it. Could
> > we please add that (along with reference to SuS) to l-k FAQ and be
> > done with that nonsense?
> I'm pretty confident that it's only standard behavior for Linux.
> Every other unix says it's not allowed.

So how about reading up on the subject instead?

*spends five minutes with Google*

>From the OpenBSD FAQ (an operating system most know for being really,
really focused on security):

Any application which has to assume root privileges to operate is
pointless to attempt to chroot(2), as root can generally escape a


You must be root to make the chroot() call, and you should quickly
change to non-root (a root user can escape a chroot environment,
so if it's to be effective, you need to drop that privilege).

A chroot FAQ:

There are well-known techniques used to escape from jail, but the
most common one requires root privileges inside the jail.

Another chroot FAT one linked to from the previous one:

This page details how the chroot() system call can be used to
provide an additional layer of security when running untrusted
programs. It also details how this additional layer of security
can be circumvented.

Whilst chroot() is reasonably secure, a program can escape from
its trap.

Yet Another FAQ, this time about secure Unix Programming:

chroot() only limits the file system scope and nothing else.

[further descriptions of how to break out of chroot, with and
without root privileges]



"Just how much can I get away with and still go to heaven?"

Christer Weinigel <christer@xxxxxxxxxxx>
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at