http://linux-vserver.org/api.php?action=feedcontributions&user=193.231.72.8&feedformat=atomLinux-VServer - User contributions [en]2024-03-28T19:31:00ZUser contributionsMediaWiki 1.20.2http://linux-vserver.org/Secure_chroot_BarrierSecure chroot Barrier2009-09-15T11:26:08Z<p>193.231.72.8: /* Breakout Methods */</p>
<hr />
<div>The chroot system call changes the root directory of the current process. This directory will be used for pathnames beginning with /. The root directory is inherited by all children of the current process.<br />
<br />
However several problems are known while using the chroot system call:<br />
<br />
* This call changes an ingredient in the pathname resolution process and does nothing else.<br />
* This call does not change the current working directory<br />
* This call does not close open file descriptors<br />
<br />
These facts disclose several ways to break out of chroot, back to the original root. Some of these methods will be outlined on this page. Additionally we will discuss how a Linux-VServer kernel prevents these breakouts.<br />
<br />
doors.txt;10;15<br />
<br />
== Solution: Secure Barrier ==<br />
<br />
While early Linux-VServer versions tried to fix this by "funny" methods, recent versions use a special marking, known as the chroot barrier, on the parent directory of each VPS to prevent unauthorized modification and escape from confinement. This barrier is implemented as a [[Filesystem Attributes|Filesystem Attribute]] and prevents a path_walk into a directory with enabled barrier.<br />
<br />
Therefore it is important to set the barrier flag on your vserver base directory, for example:<br />
<br />
<pre><br />
# setattr --barrier /vservers<br />
# showattr /vservers<br />
---Bui- /vservers<br />
---bui- /vservers/pasat<br />
</pre><br />
<br />
If you keep all the guests in one mountpoint, setting the barrier on /vservers is enough, otherwise it should be repeated for each mount point.<br />
<br />
If you want to be safe you may choose to just set the barrier for each individual guest, for example:<br />
<pre><br />
cd -P /etc/vservers/<guest>/vdir; setattr --barrier ..<br />
</pre><br />
<br />
'' Please note that it's important to set the barrier against ".." inside /path/to/guest/ ''<br />
<br />
''(note: <tt>---Bui-</tt> barrier set, <tt>---bui-</tt> barrier available and not set)''</div>193.231.72.8