Messages in this thread | | | Date | Sat, 5 Oct 2013 16:22:15 -0700 | Subject | Re: [RFC][PATCH 0/3] vfs: Detach mounts on unlink. | From | Linus Torvalds <> |
| |
On Sat, Oct 5, 2013 at 4:17 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > So learn this pattern: every time you use chroot, add a simple > > chdir("/"); > > immediately after the chroot call.
.. btw, also make sure that you close all non-essential file descriptors. Having any open directory file descriptors pointing to outside the chroot is also a classic escape.
Even then, escaping chroot is usually fairly easy. Making a escape-proof chroot is really quite hard. Basically impossible if you allow root.
Linus
| |