OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: chroot() and capabilities
From: Chris Evans (chrisferret.lmh.ox.ac.uk)
Date: Wed Aug 09 2000 - 07:27:33 CDT

On Wed, 9 Aug 2000, Ingo Luetkebohle wrote:

> On Wed, Aug 09, 2000 at 11:48:09AM +0100, Chris Evans wrote:
> > It is well known that a root process can escape a chroot() jail easily.
>
> Where can I find more information about that? I knew that it was
> possible, but never *how* and if its OS specific.

I don't know of a generic resource.

But when you start thinking about it, many ways emerge. I'll give some
examples. Many are not OS specific

- Use mknod() to create a raw disk device. Write to that to modify
anything you want outside the chroot().

- A carelessly left hard-link

- ptrace() a process outside the chroot() jail

- Mount /proc; directly modify kernel memory. Or do the same after making
/dev/mem

- Directly access hardware with iopl() and do what you want

etc.

Chris