PRoot: User-space implementation of chroot, mount –bind, and binfmt_misc

Re:PRoot: User-space implementation of chroot, mount –bind, ... by Teongot on Thursday November 28, 2024 @06:27AM (#42264451)

If you can get a suid root binary into the chroot, then you can control its configuration files to bypass security restrictions.

   $ ln /usr/bin/sudo ./my-chroot
   $ echo "$USER ALL=(ALL) NOPASSWD: ALL" > ./my-chroot/etc/sudoers.d/01-oops
   $ chroot ./my-chroot
   $ sudo bash

modern Linux distributions prevent creation of hard links to suid binaries, but the restrictions on chroot came years before that.

[ Parent | on HN ]

Re:PRoot: User-space implementation of chroot, mount –bind, ... by cedws on Thursday November 28, 2024 @07:03AM (#42264617)

Can’t SUID binaries in chroots be ignored, like the nosuid mount flag?

[ Parent | on HN ]

Re:PRoot: User-space implementation of chroot, mount –bind, ... by blueflow on Thursday November 28, 2024 @11:07AM (#42266285)

Linux namespaces can do that, with a UID namespace, you drop the ability to do SUID, and then you can open a mount namespace and bind-mount and chroot as you like.

[ Parent | on HN ]