Subject: Re: [vserver] vserver git server and misc. thoughts
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 13 Aug 2008 19:46:20 +0200

On Wed, Aug 13, 2008 at 10:28:00AM -0700, Martin Fick wrote:
> --- On Tue, 8/12/08, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> > No, cd /; mkdir foo; chroot foo; cd ../../ works as
> > documented (see chroot(2)) in all cases where CAP_SYS_CHROOT is 
> > available. The barrier is the only thing protecting the
> > host and other guests from a compromised guest.
> 
> Well, now you have really got me interested. The above does not work
> on my system, within or without a vserver I cannot escape from a
> chroot as root like that. Perhaps the chroot application is more
> secure than the chroot systemcall. So instead I went and grabbed this
> code:
> 
> http://www.bpfh.net/simes/computing/chroot-break.html
> 
> which does indeed (with the quotes from line 62 fixed) break out of
> chroots (even within vservers). However, with or without the chroot
> barrier I was unable to use this to escape a running vserver entered
> with "vserver <name> enter". So, just to solidify the theory a bit so
> I understand the threat better, does someone have a working exploit to
> break out of a vserver that they can show me?

with the barrier intact, hopefully not :)
without, one of those should do:

 http://vserver.13thfloor.at/Stuff/rootesc.c
 http://vserver.13thfloor.at/Stuff/chrootescape
 
best,
Herbert

> -Martin
> 
> 
> 
>