Unprivileged chroot()
Unprivileged chroot()
Posted Mar 17, 2021 17:58 UTC (Wed) by metalheart (guest, #89328)Parent article: Unprivileged chroot()
Posted Mar 18, 2021 1:48 UTC (Thu)
by NYKevin (subscriber, #129325)
[Link]
* If it explicitly checks geteuid() == 0, then it will continue to fail for non-root. This is probably a bad design decision, but not impossible if the application writer was trying to be "helpful" and provide a more explicit error message. On non-Linux systems, it would not be wrong to insert such a check, and some of these tools are written for "any random Unix-like" rather than Linux specifically.
TL;DR: You probably still need to be root to profitably use chroot(8), even with this patch.
Posted Mar 18, 2021 11:01 UTC (Thu)
by l0kod (subscriber, #111864)
[Link]
Unprivileged chroot()
* Unless it calls prctl() with PR_SET_NO_NEW_PRIVS, it will continue to fail for non-root. I see nothing about this in the man page for the GNU version, but it's possible a vendor might ship a version of chroot which does this. If this patch does get implemented, future versions of the GNU tool might grow a command-line argument to enable this functionality (or they might not; I can't read the GNU people's collective mind).
* Because chroot(8) runs a separate executable after doing the chroot, shared libraries etc. need to be accessible from within the chroot environment. It is complicated (but not categorically impossible) for a non-privileged user to set this up.
Unprivileged chroot()