--- On Wed, 8/13/08, Herbert Poetzl <herbert@13thfloor.at> wrote: > > > No, cd /; mkdir foo; chroot foo; cd ../../ works > > > as documented (see chroot(2)) in all cases where > > > CAP_SYS_CHROOT is available. The barrier is the > > > only thing protecting the host and other guests > > > from a compromised guest. > > > > Well, now you have really got me interested. The above > > does not work on my system, within or without a vserver > > I cannot escape from a chroot as root like that. Perhaps > > the chroot application is more secure than the > > chroot systemcall. So instead I went and grabbed this > > code: > > > > http://www.bpfh.net/simes/computing/chroot-break.html > > > > which does indeed (with the quotes from line 62 fixed) > > break out of chroots (even within vservers). However, > > with or without the chroot barrier I was unable to use > > this to escape a running vserver entered with > > "vserver <name> enter". So, just to solidify the theory a > > bit so I understand the threat better, does someone have a > > working exploit to break out of a vserver that they can > > show me? > > with the barrier intact, hopefully not :) > without, one of those should do: > > http://vserver.13thfloor.at/Stuff/rootesc.c > http://vserver.13thfloor.at/Stuff/chrootescape Well, I am sad?/happy? to report that I cannot seem to get either of those exploits to work. I have eliminated the barrier and added CAP_SYS_CHROOT to bcapabilities for one of my vservers and cannot seem to escape it. Any thoughts on what I could be doing wrong? -Martin