For sure, "a root user can get out of a chroot a million different
ways." Young Alan said as much at the beginning of this conversation,
and I have always agreed. I don't hope to secure Linux within chroot,
simply to fix chroot so that it does what it says it does.
Look, when chroot was being designed, I think they intended that even
root should be unable to get out. They went so far as to say that
dot-dot wouldn't let you out; and it doesn't. It's not dot-dot that's
the problem. Even fchdir is no problem, because you choose which file
descriptors to leave open. Fchdir is actually one of the answers.
("What if we need a way to escape?")
The problem is leaving cwd unchanged. Once you've set cwd within the
new root, dot-dot is promised to keep you within that root; and so it
does. But by leaving cwd unchanged, if you do a subsequent chroot, that
promise is suddenly broken. I think this is a bug. I think that
behavior was not intended. Not all agree with me, but obviously a lot
do, otherwise OpenBSD and others wouldn't have addressed this exact
issue. Here's what they do:
"If the program is already running with an altered root directory,
the process's current directory is changed to the same new root
directory. This prevents the current directory from being further
up the directory tree than the altered root directory."
-- OpenBSD man 2 chroot
This was no more than an attempt to fix a long-standing bug.
As stated, opinion is divided as to whether this is a bug. I think it
is, and many people agree, for example some of the BSDs and probably
others; some people don't. Young Alan, for example, ummm, strongly (is
a good word) disagrees. I don't see that it calls for nastiness or
emotion, and although opinion on this august list is divided, apparently
the nays are in the majority. We should leave it at that.
-
