Re: prevent breaking a chroot() jail?

[Alan Cox]

> work (most likely only for a subset of processes, i.e. processes that
> are run in the jail end up getting a marker which is passed down to all
> their children that causes the syscalls to behave differently).
> 
> What should I be aware of?  I figure devices (no need to run mknod in
> this jail) and chroot (as per man page), is there any other way of
> breaking the chroot jail (at a syscall level or otherwise)?
> 
> or is this 100% impossible?

Its hairy. You need to avoid devices, root, fd passing from untrusted agents
outside the chroot world and shared uid (ptrace) attacks. If you are outside the
USA you can do this with NSA SE Linux although in the US you may hit the
type enforcement patents.

Alan