Re: Chroot jails

[Antoine Martin <antoine () nagafix co uk>]

> > Wondered if people could give me their opinions on chroot jails
> > > AFAIK, chroot on linux is fundamentally insecure - look for the
> > > 'chroot-again' flaw.
> > > Last time I checked it still worked and allowed to escape.
> A chrooted jail without dropping privileges is vain anyway.
Indeed.
Which is why I prefer:
http://www.suse.de/~marc/compartment.html
Unlike chroot you can drop privileges in one swoop.
It deserves to be mentioned in this thread.

> The only way to escape would be some executable on the machine
> with suid a/o sguid flag set that performs the "chroot-again" for the
> in-jail process.
Or through some other (combination of) exploit(s) - which is reasonably
hard to do, but not impossible.

> If you have something like that on your machine, or there is any non-root
> user who is able to install something like that there, then you can consider 
> your system to be compromised anyway...
You don't want to have local users anywhere near the chroot, but if you
have to, see below.

> (The problem is, that most web-app related stuff out there does NOT
> disable suid executables, so you have to triple check that the process
> in the jail will never be able to exec something with effective uid 0)
Which is effectively what SELinux does with state transitions, without
forcing you to inspect all the executables (least privilege).

Antoine