Re: Non-root chroot

Dmitry Mikushin <dmitry@kernelgen.org> wrote:

> Important point is that the user is not obliged to hand in any particular
> "su" program. The user may hand in any "su"-like code suitable for escaping
> the chroot.

But just as it is if you're not using a chroot, your non-root user cannot
create suid-root binaries, and when you're setting things up, you'd simply not
use root to copy a suid-root 'su' (or anything else) into your chroot tree.

Or, you could have the chroot on a partition with nosuid set, so even if
you did put an suid-root binary there, the suid bit would be ignored anyway.

In other words, there is nothing magic a non-root user can do in a normal
chroot - indeed, many daemons etc. run a chroot command and then setuid to
a non-privilege user to run in a contained manner.

Cheers, Jamie