On Wed, Aug 13, 2008 at 10:28:00AM -0700, Martin Fick wrote:
> --- On Tue, 8/12/08, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> > No, cd /; mkdir foo; chroot foo; cd ../../ works as
> > documented (see chroot(2)) in all cases where CAP_SYS_CHROOT is
> > available. The barrier is the only thing protecting the
> > host and other guests from a compromised guest.
>
> Well, now you have really got me interested. The above does not work
> on my system, within or without a vserver I cannot escape from a
> chroot as root like that. Perhaps the chroot application is more
> secure than the chroot systemcall. So instead I went and grabbed this
> code:
>
> http://www.bpfh.net/simes/computing/chroot-break.html
>
> which does indeed (with the quotes from line 62 fixed) break out of
> chroots (even within vservers). However, with or without the chroot
> barrier I was unable to use this to escape a running vserver entered
> with "vserver <name> enter". So, just to solidify the theory a bit so
> I understand the threat better, does someone have a working exploit to
> break out of a vserver that they can show me?
with the barrier intact, hopefully not :)
without, one of those should do:
http://vserver.13thfloor.at/Stuff/rootesc.c
http://vserver.13thfloor.at/Stuff/chrootescape
best,
Herbert
> -Martin
>
>
>
>