Subject: Re: [vserver] vserver git server and misc. thoughts
From: Martin Fick <mogulguy@yahoo.com>
Date: Wed, 13 Aug 2008 10:28:00 -0700 (PDT)

--- On Tue, 8/12/08, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> No, cd /; mkdir foo; chroot foo; cd ../../ works as
> documented (see chroot(2)) in all cases where CAP_SYS_CHROOT is 
> available. The barrier is the only thing protecting the
> host and other guests from a compromised guest.

Well, now you have really got me interested.  The above does not work on my system,
within or without a vserver I cannot escape from a chroot as root like that.  Perhaps
the chroot application is more secure than the chroot systemcall.  So instead I went
and grabbed this code:

http://www.bpfh.net/simes/computing/chroot-break.html

which does indeed (with the quotes from line 62 fixed) break out of chroots (even within
vservers).  However, with or without the chroot barrier I was unable to use this to
escape a running vserver entered with "vserver <name> enter".  So, just to solidify
the theory a bit so I understand the threat better, does someone have a working exploit
to break out of a vserver that they can show me?

-Martin