lkml.org 
[lkml]   [2013]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/3] Patches to enable chroot for all users
Date
I want to suggest adding chroot capability to all users.
The following patches enable that capability, while considering the security mechanism needed to disable escape routes for chroots by non-root users,
and keeping chroot backward-compatible for root users.
The first patch establishes the concept of multi-user chroot, while disabling checks for root user in the chroot process.
The second patch checks whether a fd that is sent to a chroot application by a non-root user refers to a directory.
If that is the case, that fd is skipped, to disable an escape route.
The third patch disables the option for applications that have open fds to directories to be chrooted by a non-root user.

Any comments, feedback and suggestions are appreciated!

Thanks,
Tal


Tal Tchwella (3):
enabled chroot for all users
socket checks for uds fds transfer
open fds check when starting chroot

fs/exec.c | 3 +++
fs/open.c | 32 ++++++++++++++++++++++++++++++--
include/linux/sched.h | 12 ++++++++++++
init/main.c | 1 +
kernel/fork.c | 2 ++
net/core/scm.c | 9 +++++++++
6 files changed, 57 insertions(+), 2 deletions(-)

--
1.7.9.5



\
 
 \ /
  Last update: 2013-03-20 14:21    [W:0.038 / U:2.836 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site