Subject: Re: [vserver] vserver git server and misc. thoughts
From:Björn Steinbrink <B.Steinbrink@gmx.de>
Date: Wed, 13 Aug 2008 22:07:57 +0200

On 2008.08.13 12:04:05 -0700, Martin Fick wrote:
> --- On Wed, 8/13/08, Herbert Poetzl <herbert@13thfloor.at> wrote:
> 
> > > > No, cd /; mkdir foo; chroot foo; cd ../../ works
> > > > as documented (see chroot(2)) in all cases where
> > > > CAP_SYS_CHROOT is available. The barrier is the 
> > > > only thing protecting the host and other guests 
> > > > from a compromised guest.
> > > 
> > > Well, now you have really got me interested. The above
> > > does not work on my system, within or without a vserver 
> > > I cannot escape from a chroot as root like that. Perhaps 
> > > the chroot application is more secure than the 
> > > chroot systemcall. So instead I went and grabbed this
> > > code:
> > > 
> > > http://www.bpfh.net/simes/computing/chroot-break.html
> > > 
> > > which does indeed (with the quotes from line 62 fixed)
> > > break out of chroots (even within vservers). However, 
> > > with or without the chroot barrier I was unable to use 
> > > this to escape a running vserver entered with 
> > > "vserver <name> enter". So, just to solidify the theory a 
> > > bit so I understand the threat better, does someone have a
> > > working exploit to break out of a vserver that they can 
> > > show me?
> > 
> > with the barrier intact, hopefully not :)
> > without, one of those should do:
> > 
> >  http://vserver.13thfloor.at/Stuff/rootesc.c
> >  http://vserver.13thfloor.at/Stuff/chrootescape
> 
> 
> Well, I am sad?/happy? to report that I cannot seem to get 
> either of those exploits to work. I have eliminated the 
> barrier and added CAP_SYS_CHROOT to bcapabilities for one
> of my vservers and cannot seem to escape it.  Any thoughts
> on what I could be doing wrong?

I've been away from this stuff for quite a while, but the last exploit
I've "seen" required you not to step past the /-bind-mount, so the
chdir("..") loop needs to stop at the right point. That usually puts you
in /vservers then IIRC, it's been quite I while since I did that one.
Not sure whether I figured out if/how you can get rid of that bind mount
(well, except if you have permissions to umount it), to reach the real
root mount, but you could at the very least visit the other vservers.

If that still doesn't work, let me know. I might dig into my archives
and see if I still have the sources for that one.

HTH
Björn