lkml.org 
[lkml]   [2013]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 0/3] Patches to enable chroot for all users
On 03/20/2013 07:53:42 AM, Tal Tchwella wrote:
> I want to suggest adding chroot capability to all users.

I note that chroot doesn't quite do what most people think it does:

http://landley.net/notes-2011.html#02-06-2011

I've had a todo item forever to modify chroot to actually change the
process-local mount tree, creating a bind mount if necessary for the
new directory, reparenting the mount tree to that bind mount, and
making sure that reference counting can free unused mounts that this
would discard. (Except rootfs always needs a nonzero reference count.)

The problem isn't adding security checks, the problem is that having a
"/" symlink point somewhere _other_ than the actual top of the
process-local mount tree is obsolete now that there isn't a single
global mount tree for all processes. (Yes, this would mean it might
need to create a new namespace.)

Rob

\
 
 \ /
  Last update: 2013-03-20 17:01    [W:0.040 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site