chroots & uid sharing

["Jason A. Donenfeld" <Jason () zx2c4 com>]

Hi folks,

Some people would be surprised to learn you can ptrace processes from
inside chroots that exist outside of chroots. So, if there are two
processes, one chrooted, and one unchrooted, both using the same UID,
you can ptrace your way out of the chroot pretty easily. Grsecurity
actually adds a little nob to the kernel to disallow this.

What I wonder is how many distros are shipping various daemons that
run under the nobody user, with certain ones chrooting and others not.
How should we handle this?

More generally, I'm wondering what the attitude should be toward this
kind of violation when it occurs within a particular daemon. For
example, OpenSMTPD forks a bunch of processes, and drops privs of some
and chroots others. But they violate the uid-per-chroot rule,
rendering the chroots useless. Should this be considered a security
flaw? Or just a silly design consideration?

This disgusting and offensive one-liner shows such flawed chroots:

krantz ~ # for i in /proc/[0-9]*; do echo $(readlink -f $i/root)
$(stat -c "%u %g" $i 2>/dev/null); done | sort | uniq | egrep "$(for i
in /proc/[0-9]*; do if [ "$(readlink -f $i/root)" != "/" ]; then stat
-c "%u %g" $i 2>/dev/null; fi; done | sort | uniq | tr '\n' '|' | head
-c -1)" | ( u=""; l=""; while read line; do nu="$(cut -d ' ' -f 2,3
<<<"$line")"; if [ "$nu" == "$u" ]; then if [ "$l" != "" ]; then echo
"$l"; fi; echo "$line"; else l="$line"; fi; u="$nu"; done )
/ 25 25
/var/empty 25 25


Thoughts?

Jason