Re: can chroot be made safe for non-root?

[David Wagner]

Philippe Troin  wrote:
>[e-mail] (David Wagner) writes:
>> Philippe Troin  wrote:
>> >  fd = open("/", O_RDONLY);
>> >  chroot("/tmp");
>> >  fchdir(fd);
>> >
>> >and you're out of the chroot.
>> 
>> Irrelevant.  If a process *wants* to voluntarily sandbox itself, it can
>> close all open file descriptors before sandboxing.
>
>You missed the point.
>
>If the process can be forced to run the above (possibly via a stack
>overflow), then it is out of the chroot.

Ahh, yes.  Exactly so.  My apologies for missing your point.

Still, I don't think this is a big deal.  The problem is that if
a chroot-ed process can call chroot() again, it can escape from the
chroot jail.  There is one obvious solution: simply don't allow chroot-ed
process to call chroot() again.  This is addressed in the link I posted
previously.

So I still think that chroot() could plausibly be made safe for non-root
users.