Alex Behar wrote:
Good morning Amos,
LD_DEBUG (as of early glibc 2.3 versions IIRC), LD_LIBRARY_PATH and LD_PRELOAD do not work on SUID binaries, unless you are root.
Further more, there are ways to achieve the goal Shaul needs by using capabilities(7).
I would recommand a very small hack for chrooting dynamic executables without having to deal with library dependencies:
http://chrootsafe.sourceforge.net/
Sounds like a very useful tool!
That small utility can be changed and tweaked easily for custom needs (wrappers for example).If you have root, you can also chroot. The question was what to do when you don't have root, but you want to get one :-).
Also, Gilad, a binary will keep its permissions and attributes if copied while root and by using the "-a" flag to cp, consult the man pages for more details.
While you cannot copy a binary and have it retain its permissions (and suid in particular), you can hard link it into a different environment. If I had chroot as non-root, I could:
mkdir ~/root and ~/root/lib
ln /bin/ping ~/root/ping
cp /bin/bash ~/root/
put my own, specially crafted, library in ~/root/lib/libc.so.6
chroot to ~/root and run ping. Ping would load my libc.so.6, and I could do whatever I wanted as root (say, chown root /bash and chmod u+s /bash, which means that outside the root shell I have a SUID root bash at ~/root/bash).
Presco - I have a root shell.
To mitigate this:
- Make sure all user writable partitions are separate from / and /usr (cannot hard link across partitions, and soft links are useless inside the chroot jail).
- Make sure all user writable partitions are mounted -o nosuid,nodev. You can even do noexec, but it's fairly easy to bypass that one.
And, of course, the obvious:
- Don't allow non-root to chroot :-)
Kind regards,
Alex
Shachar
-- Shachar Shemesh Lingnu Open Source Consulting ltd. Have you backed up today's work? http://www.lingnu.com/backup.html
================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
