[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAFCLFXuj5RggM6am+CiMZOMFKzchHyfeUh72A0XnGRG+WbdktQ@mail.gmail.com>
Date: Fri, 7 Jun 2013 16:54:16 -0700
From: Tom Maher <tmaher@...oku.com>
To: oss-security@...ts.openwall.com
Subject: Re: chroots & uid sharing
On Thu, Jun 6, 2013 at 8:26 PM, Kurt Seifried <kseifried@...hat.com> wrote:
> I literally can't remember when people started saying "if you're using
> chroot for security, you're doing it wrong" it was a long time ago. At
> least a decade for myself and I wasn't the first person (that probably
> goes to the BSD guys and jail()):
>
> http://seclists.org/vuln-dev/2002/May/419
This assertion has always bugged me. Yes, if you are using chroot for
security, and only chroot for security, you're absolutely doing it
wrong. However, when used with an awareness of its limitations, as
you quite rightly point out and enumerate, I argue chroot (and its
more sophisticated cousins jail and pivot_root) does in fact provide
some defense. For example, think multiple different,
mutually-distrusting applications on a host, one of which has a simple
directory traversal bug, and the other of which mistakenly has
sensitive files set to be world readable (but without any directory
traversal issues). chroot is great for that.
I would be less bugged by this if I hadn't repeatedly encountered
well-intentioned folks who hear that argument and think that chroot is
completely useless for security enforcement, rather than simply
insufficient.
--
Tom Maher <tmaher@...oku.com>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
