Re: chroot() breaks syslog() ?

["Herbert Pötzl" <herbert@13thfloor.at>]

On Wed, Aug 06, 2003 at 10:42:40AM +0200, Oliver Pitzeier wrote:
> > > IMHO, devfs in chroot environment, is defeating the purpose 
> > > because if you have access to raw devices, like the device
> > > your chroot dir is on, 
> > > you can easily mount that device again, and voila you have 
> > > access to 
> > > the full tree, if you
> > 
> > You need to be root to mount the device, and as root you can 
> > also create the device special file. A chroot environment 
> > does not reliably guard against root breaking out of it.
> 
> That's not completly wrong nor is it completly true. :)
> 
> You _CAN_ guard yourself from root's breaking out of some chroot environment.
> Using grsec (www.grsecurity.net). Denying double-chroots, creation of special
> files within chroot-environments and if you like it... Deny mounting within
> chroot. :)

hmm, how will you avoid creation of special (devicenodes)
files if I have raw access to any partition? I can 'simply'
use xxd to create my special inodes on the medium ...
and I would not care if mount is enabled or not when I
wipe the root partition with dd ...

best,
Herbert

> There are many options provided - just use 'em. :)
> 
> Best regards,
>  Oliver