Subject: Re: [vserver] vserver git server and misc. thoughts
From: Martin Fick <mogulguy@yahoo.com>
Date: Wed, 13 Aug 2008 12:04:05 -0700 (PDT)

--- On Wed, 8/13/08, Herbert Poetzl <herbert@13thfloor.at> wrote:

> > > No, cd /; mkdir foo; chroot foo; cd ../../ works
> > > as documented (see chroot(2)) in all cases where
> > > CAP_SYS_CHROOT is available. The barrier is the 
> > > only thing protecting the host and other guests 
> > > from a compromised guest.
> > 
> > Well, now you have really got me interested. The above
> > does not work on my system, within or without a vserver 
> > I cannot escape from a chroot as root like that. Perhaps 
> > the chroot application is more secure than the 
> > chroot systemcall. So instead I went and grabbed this
> > code:
> > 
> > http://www.bpfh.net/simes/computing/chroot-break.html
> > 
> > which does indeed (with the quotes from line 62 fixed)
> > break out of chroots (even within vservers). However, 
> > with or without the chroot barrier I was unable to use 
> > this to escape a running vserver entered with 
> > "vserver <name> enter". So, just to solidify the theory a 
> > bit so I understand the threat better, does someone have a
> > working exploit to break out of a vserver that they can 
> > show me?
> 
> with the barrier intact, hopefully not :)
> without, one of those should do:
> 
>  http://vserver.13thfloor.at/Stuff/rootesc.c
>  http://vserver.13thfloor.at/Stuff/chrootescape


Well, I am sad?/happy? to report that I cannot seem to get 
either of those exploits to work. I have eliminated the 
barrier and added CAP_SYS_CHROOT to bcapabilities for one
of my vservers and cannot seem to escape it.  Any thoughts
on what I could be doing wrong?

-Martin