--- On Tue, 8/12/08, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> No, cd /; mkdir foo; chroot foo; cd ../../ works as
> documented (see chroot(2)) in all cases where CAP_SYS_CHROOT is
> available. The barrier is the only thing protecting the
> host and other guests from a compromised guest.
Well, now you have really got me interested. The above does not work on my system,
within or without a vserver I cannot escape from a chroot as root like that. Perhaps
the chroot application is more secure than the chroot systemcall. So instead I went
and grabbed this code:
http://www.bpfh.net/simes/computing/chroot-break.html
which does indeed (with the quotes from line 62 fixed) break out of chroots (even within
vservers). However, with or without the chroot barrier I was unable to use this to
escape a running vserver entered with "vserver <name> enter". So, just to solidify
the theory a bit so I understand the threat better, does someone have a working exploit
to break out of a vserver that they can show me?
-Martin