From owner-freebsd-security@FreeBSD.ORG  Sun Apr 13 16:13:21 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3988037B401; Sun, 13 Apr 2003 16:13:21 -0700 (PDT)
Received: from milla.ask33.net (milla.ask33.net [217.197.166.60])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 68EB343F85; Sun, 13 Apr 2003 16:13:20 -0700 (PDT)
	(envelope-from nick@milla.ask33.net)
Received: by milla.ask33.net (Postfix, from userid 1001)
	id D061C3ABB4D; Mon, 14 Apr 2003 01:13:56 +0200 (CEST)
Date: Mon, 14 Apr 2003 01:13:56 +0200
From: Pawel Jakub Dawidek <nick@garage.freebsd.pl>
To: Ruslan Ermilov <ru@freebsd.org>
Message-ID: <20030413231356.GC52293@garage.freebsd.pl>
References: <5.2.0.9.2.20030413101417.022481b0@127.0.0.1>
	<20030413154146.GB92320@sunbay.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="JgQwtEuHJzHdouWu"
Content-Disposition: inline
In-Reply-To: <20030413154146.GB92320@sunbay.com>
X-PGP-Key-URL: http://garage.freebsd.pl/jules.asc
X-OS: FreeBSD 4.8-RELEASE i386
X-URL: http://garage.freebsd.pl
User-Agent: Mutt/1.5.1i
cc: freebsd-security@freebsd.org
cc: Mark Shepard <mns@BEST.COM>
Subject: Re: chroot() as non-root user?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 23:13:21 -0000


--JgQwtEuHJzHdouWu
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Apr 13, 2003 at 06:41:46PM +0300, Ruslan Ermilov wrote:
+> chroot(2) has no effect on the process's current directory; you
+> could hide (hard-link) the setuid program (su(1)) there, so
+> removing this protection on the syscall level can easily result
+> in a compromise.
+>=20
+> chroot(8) changes the current working directory, but it's not
+> setuid root.

And if kern.chroot_allow_open_directories is set to 0?

--=20
Pawel Jakub Dawidek                       pawel@dawidek.net
UNIX Systems Programmer/Administrator     http://garage.freebsd.pl
Am I Evil? Yes, I Am!                     http://cerber.sourceforge.net

--JgQwtEuHJzHdouWu
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iQCVAwUBPpnvND/PhmMH/Mf1AQHjlAP/Ryfb5NeTeqXltHB1bdgiPEsUkoIKDwiz
nWP5ksN8k5B5WeCt+LhJdc3aN9rcxtE4/NWukfh4zesmsqz6PnkZqcIljLwNVEIj
EjgKVgyA9x0aRuQ6OC0MXnWM8YZ8viw1CvfAhouQaF3c5WITPBhn9cJ8HjIrt07h
WufxPLOD9Q8=
=GNPz
-----END PGP SIGNATURE-----

--JgQwtEuHJzHdouWu--