🚀 go-pugleaf

In article <1992Aug15.093848.9784@dircon.co.uk> uaa1006@dircon.co.uk writes:
>
>I'm developing a system which uses the chroot(S) call to limit 
>the area a user can access on a UNIX system.
>
>I have a program which is SUID root, which runs chroot and then
>sets the UID of the process to that of the user, and spawns 
>/bin/sh (which is present under the chroot path).
>
>My question is....how secure is this? Are there any areas I 
>should look out for to ensure that no one can access other parts 
>of the system?
>
>General comments and observations about the chroot facility 
>would also be of interest.
>
>I should add that under the chroot area, I've created a /dev
>directory, containing entries for /dev/null, /dev/tty, /dev/socksys 
>(for outgoing ftp/telnet).
>
I haven't tried this myself (maybe I will in the next day or so),
but if a user gains root privileges, whats to stop them mknod'ing a
disk device and accessing the rest of the world via that?
(or have I overlooked something?)

Gary