Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 27 Mar 2021 19:56:23 +0100
From: Mickaël Salaün <>
To: Askar Safin <>
Subject: Re: [PATCH v5 1/1] fs: Allow no_new_privs tasks to call chroot(2)

On 27/03/2021 00:12, Askar Safin wrote:
> Hi. Unprivileged users already can do chroot. He should simply create userns and then call "chroot" inside. As an LWN commenter noted, you can simply run 
> "unshare -r /usr/sbin/chroot some-dir". (I recommend reading all comments: .)

We know that userns can be use to get the required capability in a new
namespace, but this patch is to not require to use this namespace, as
explained in the commit message. I already added some comments in the
LWN article though.

> Also: if you need chroot for path resolving only, consider openat2 with RESOLVE_IN_ROOT ( ).

openat2 was also discussed in previous versions of this patch.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.