🚀 go-pugleaf

gary@nexnix.demon.co.uk (Gary Howland) writes:
}uaa1006@dircon.co.uk writes:

}>I have a program which is SUID root, which runs chroot and then
}>sets the UID of the process to that of the user, and spawns 
}>/bin/sh (which is present under the chroot path).

}>My question is....how secure is this?

}I haven't tried this myself (maybe I will in the next day or so),
}but if a user gains root privileges, whats to stop them mknod'ing a
}disk device and accessing the rest of the world via that?
}(or have I overlooked something?)

What you do have to worry about is making sure that the permissions on
your new root directory (and other important dirs below it, like "/dev"
mentioned above and "/etc") prevent the user from writing into it.
For example:

	% yournewrootpgm
	% mkdir /etc
	% echo "root::0:1:System PRIVILEGED Account:/:/bin/csh" >/etc/passwd
	% su   (which they may have to copy in too, but you get the idea)

John
-- 
John Hascall                                       ``Live with it pink-boy!''
Project Vincent                                                              
Iowa State University Computation Center                     john@iastate.edu
Ames, IA  50011                                      515/294-9551 [fax -1717]