Re: chroots & uid sharing

[Tom Maher <tmaher () heroku com>]

On Thu, Jun 6, 2013 at 8:26 PM, Kurt Seifried <kseifried () redhat com> wrote:
> I literally can't remember when people started saying "if you're using
> chroot for security, you're doing it wrong" it was a long time ago. At
> least a decade for myself and I wasn't the first person (that probably
> goes to the BSD guys and jail()):
>
> http://seclists.org/vuln-dev/2002/May/419

This assertion has always bugged me.  Yes, if you are using chroot for
security, and only chroot for security, you're absolutely doing it
wrong.  However, when used with an awareness of its limitations, as
you quite rightly point out and enumerate, I argue chroot (and its
more sophisticated cousins jail and pivot_root) does in fact provide
some defense.  For example, think multiple different,
mutually-distrusting applications on a host, one of which has a simple
directory traversal bug, and the other of which mistakenly has
sensitive files set to be world readable (but without any directory
traversal issues).  chroot is great for that.

I would be less bugged by this if I hadn't repeatedly encountered
well-intentioned folks who hear that argument and think that chroot is
completely useless for security enforcement, rather than simply
insufficient.

-- 
Tom Maher <tmaher () heroku com>