Re: [PATCH v5 1/1] fs: Allow no_new_privs tasks to call chroot(2)

From: Askar Safin
Date: Fri Mar 26 2021 - 19:37:35 EST

Next message: Kuppuswamy Sathyanarayanan: "[PATCH v2 1/1] x86/tdx: Add __tdcall() and __tdvmcall() helper functions"
Previous message: Andrii Nakryiko: "Re: [PATCH bpf-next 1/5] tools pkt_cls.h: sync with kernel sources"
Next in thread: Mickaël Salaün: "Re: [PATCH v5 1/1] fs: Allow no_new_privs tasks to call chroot(2)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi. Unprivileged users already can do chroot. He should simply create userns and then call "chroot" inside. As an LWN commenter noted, you can simply run
"unshare -r /usr/sbin/chroot some-dir". (I recommend reading all comments: https://lwn.net/Articles/849125/ .)

Also: if you need chroot for path resolving only, consider openat2 with RESOLVE_IN_ROOT ( https://lwn.net/Articles/796868/ ).

==
Askar Safin
https://github.com/safinaskar

Next message: Kuppuswamy Sathyanarayanan: "[PATCH v2 1/1] x86/tdx: Add __tdcall() and __tdvmcall() helper functions"
Previous message: Andrii Nakryiko: "Re: [PATCH bpf-next 1/5] tools pkt_cls.h: sync with kernel sources"
Next in thread: Mickaël Salaün: "Re: [PATCH v5 1/1] fs: Allow no_new_privs tasks to call chroot(2)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]