|
|
Subscribe / Log in / New account

Unprivileged chroot()

Unprivileged chroot()

Posted Mar 17, 2021 17:58 UTC (Wed) by metalheart (guest, #89328)
Parent article: Unprivileged chroot()

Kernel noob here. This change will not affect the /usr/sbin/chroot tool?


to post comments

Unprivileged chroot()

Posted Mar 18, 2021 1:48 UTC (Thu) by NYKevin (subscriber, #129325) [Link]

It depends on how your system's chroot(8) was written.

* If it explicitly checks geteuid() == 0, then it will continue to fail for non-root. This is probably a bad design decision, but not impossible if the application writer was trying to be "helpful" and provide a more explicit error message. On non-Linux systems, it would not be wrong to insert such a check, and some of these tools are written for "any random Unix-like" rather than Linux specifically.
* Unless it calls prctl() with PR_SET_NO_NEW_PRIVS, it will continue to fail for non-root. I see nothing about this in the man page for the GNU version, but it's possible a vendor might ship a version of chroot which does this. If this patch does get implemented, future versions of the GNU tool might grow a command-line argument to enable this functionality (or they might not; I can't read the GNU people's collective mind).
* Because chroot(8) runs a separate executable after doing the chroot, shared libraries etc. need to be accessible from within the chroot environment. It is complicated (but not categorically impossible) for a non-privileged user to set this up.

TL;DR: You probably still need to be root to profitably use chroot(8), even with this patch.

Unprivileged chroot()

Posted Mar 18, 2021 11:01 UTC (Thu) by l0kod (subscriber, #111864) [Link]

This should work with setpriv --no-new-privs /usr/sbin/chroot /new/root /bin/sh


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds