Messages in this thread | | | From | David Laight <> | Subject | RE: [PATCH v2 1/1] fs: Allow no_new_privs tasks to call chroot(2) | Date | Thu, 11 Mar 2021 09:45:43 +0000 |
| |
From: Eric W. Biederman > Sent: 10 March 2021 19:24 ... > The actual classic chroot escape is. > chdir("/"); > chroot("/somedir"); > chdir("../../../..");
That one is easily checked.
I thought something like: chroot("/somedir"); chdir("/somepath");
Friendly process: mvdir("/somedir/some_path", "/bar");
was the actual escape?
David
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
| |