Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jun 2013 15:02:37 +0200
From: "Jason A. Donenfeld" <>
To: oss-security <>
Subject: chroots & uid sharing

Hi folks,

Some people would be surprised to learn you can ptrace processes from
inside chroots that exist outside of chroots. So, if there are two
processes, one chrooted, and one unchrooted, both using the same UID,
you can ptrace your way out of the chroot pretty easily. Grsecurity
actually adds a little nob to the kernel to disallow this.

What I wonder is how many distros are shipping various daemons that
run under the nobody user, with certain ones chrooting and others not.
How should we handle this?

More generally, I'm wondering what the attitude should be toward this
kind of violation when it occurs within a particular daemon. For
example, OpenSMTPD forks a bunch of processes, and drops privs of some
and chroots others. But they violate the uid-per-chroot rule,
rendering the chroots useless. Should this be considered a security
flaw? Or just a silly design consideration?

This disgusting and offensive one-liner shows such flawed chroots:

krantz ~ # for i in /proc/[0-9]*; do echo $(readlink -f $i/root)
$(stat -c "%u %g" $i 2>/dev/null); done | sort | uniq | egrep "$(for i
in /proc/[0-9]*; do if [ "$(readlink -f $i/root)" != "/" ]; then stat
-c "%u %g" $i 2>/dev/null; fi; done | sort | uniq | tr '\n' '|' | head
-c -1)" | ( u=""; l=""; while read line; do nu="$(cut -d ' ' -f 2,3
<<<"$line")"; if [ "$nu" == "$u" ]; then if [ "$l" != "" ]; then echo
"$l"; fi; echo "$line"; else l="$line"; fi; u="$nu"; done )
/ 25 25
/var/empty 25 25



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.