in looking through the code, it seems the follow_dotdot() function in
fs/namei.c is the ultimate part of how the kernel keeps programs jailed
into a chroot.
basically (very basic) what it appears to do is
if (place we chrooted == current place)
{
we're at the root
} otherwise we aren't
If we would have a linked list of chroot points, and whenever we hit one
of those points in a walk, we treat it as a root, wouldn't this chain
any fd's one brought into a chroot to the original root of that fd.
yes, there are other things that would have to be taken care of to make
a chroot jail more secure, but this should be an easy thing, correct? or
am I missing more.
thanks,
shaya
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed Oct 23 2002 - 22:00:50 EST