Re: Different roots for each process possible?
> Hmm. On Unix, the reason why chroot requiers special privileges, is
> that if you are inside a chroot prison and is allowed to call chroot,
> you can do
>
> cd / # Get to the top of the prison.
> mkdir foo
> chroot foo # Lower the ceiling.
> cd .. # We're above the ceiling, so just fly away.
Nothing prevents you from doing that, because you are keeping a pointer, in
the form of the current working directory, to a pre-chroot directory. So
it is important that programs using chroot for security do chdir("/") or
suchlike immediately after chroot.
The way chroot works in the Hurd is that the root directory port is
replaced by a port on which lookups of ".." just go to ".". Any ports
looked up from that directory have pointers back to that context, and
travelling back up by ".." links retains that context. So there are no
lookups that can see out of the "prison"--only preexisting pointers like
the cwd or file descriptors. (And of course a setuid exec will revert to
the system-global root directory.)
Reply to: