Re: Chroot jails

[Ingo Struck <ingo () ingostruck de>]

Hi...

> Wondered if people could give me their opinions on chroot jails
> > AFAIK, chroot on linux is fundamentally insecure - look for the
> > 'chroot-again' flaw.
> > Last time I checked it still worked and allowed to escape.
A chrooted jail without dropping privileges is vain anyway.

For the "chroot-again" exploit to work you need to be able to
execute something within the jail as root or with root privileges.

So the process running in the "jail" *must* drop root privileges after
the chroot.

e.g. (C snippet)
=== snip ===
  if (chdir( "/tmp/jaildir") ) die();
  if (chroot(".")) die();
  if (-1==setuid(jailuid)) die();
=== snap ===

After dropping privileges the process will not be able to chroot again.

The only way to escape would be some executable on the machine
with suid a/o sguid flag set that performs the "chroot-again" for the
in-jail process.
If you have something like that on your machine, or there is any non-root
user who is able to install something like that there, then you can consider 
your system to be compromised anyway...
(The problem is, that most web-app related stuff out there does NOT
disable suid executables, so you have to triple check that the process
in the jail will never be able to exec something with effective uid 0)

bottom line: 
a well-done chrooted jail could be made unescapeable,
but you have to know what you do and keep a lot of 
auxiliary conditions in mind. Generally this is far more difficult
if you have (untrusted) local users on the considered machine.

HTH & kind regards

Ingo Struck