Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sun, 2 Oct 2022 00:11:50 +0100
From:   Al Viro <viro@zeniv.linux.org.uk>
To:     David Laight <David.Laight@aculab.com>
Cc:     "'Eric W. Biederman'" <ebiederm@xmission.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [CFT][PATCH] proc: Update /proc/net to point at the accessing
 threads network namespace
Message-ID: <YzjJNnzRTiSpwXHV@ZenIV>
References: <YzXrOFpPStEwZH/O@ZenIV>
 <CAHk-=wjLgM06JrS21W4g2VquqCLab+qu_My67cv6xuH7NhgHpw@mail.gmail.com>
 <YzXzXNAgcJeJ3M0d@ZenIV>
 <YzYK7k3tgZy3Pwht@ZenIV>
 <CAHk-=wihPFFE5KcsmOnOm1CALQDWqC1JTvrwSGBS08N5avVmEA@mail.gmail.com>
 <871qrt4ymg.fsf@email.froward.int.ebiederm.org>
 <87ill53igy.fsf_-_@email.froward.int.ebiederm.org>
 <ea14288676b045c29960651a649d66b9@AcuMS.aculab.com>
 <87a66g25wm.fsf@email.froward.int.ebiederm.org>
 <9bf5e96b383e4a979618cb0f729cb833@AcuMS.aculab.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <9bf5e96b383e4a979618cb0f729cb833@AcuMS.aculab.com>
Sender: Al Viro <viro@ftp.linux.org.uk>
Precedence: bulk

On Fri, Sep 30, 2022 at 09:28:31PM +0000, David Laight wrote:
> > > FWIW I'm pretty sure there a sequence involving unshare() that
> > > can get you out of a chroot - but I've not found it yet.
> > 
> > Out of a chroot is essentially just:
> > 	chdir("/");
> >         chroot("/somedir");
> >         chdir("../../../../../../../../../../../../../../../..");
> 
> A chdir() inside a chroot anchors at the base of the chroot.
> fchdir() will get you out if you have an open fd to a directory
> outside the chroot.
> The 'usual' way out requires a process outside the chroot to
> just use mvdir().
> But there isn't supposed to be a way to get out.

In order of original claims:

* chdir inside a chroot does *NOT* "anchor at the base of the chroot".
What it does is (a) start at the base if the pathname is absolute and
(b) treats .. in the base as ., same as any other syscall.

* correct.

* WTF is "mvdir()"?  Some Unices used to have mvdir(1), but it had never
been a function...  And mv(1) (or rename(2)) is far from being the only
way for assistant outside of jail to let the chrooted process out.

* ability to chroot(2) had always been equivalent to ability to undo
chroot(2).  If you want to prevent getting out of there, you need
(among other things) to prevent the processes to be confined from
further chroot(2).