[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] Re: [V8 PATCH 11/11] virtio-9p: Chroot environment for othe

From: Stefan Hajnoczi
Subject: [Qemu-devel] Re: [V8 PATCH 11/11] virtio-9p: Chroot environment for other functions
Date: Thu, 10 Mar 2011 12:29:13 +0000

On Wed, Mar 9, 2011 at 5:16 PM, M. Mohan Kumar <address@hidden> wrote:
> Add chroot functionality for systemcalls that can operate on a file
> using relative directory file descriptor.

I suspect the relative directory approach is broken and escapes the
chroot.  Here's why:

The request is local_chmod(fs_ctx, "/..", credp).  dirname("/..") is
"/" and basename("..") is "..".

I'm not 100% sure of the semantics but I suspect that chmodat(dir_fd,
"..", ...) does not honor the chroot since your current task is not
inside the chroot.  If so, then you can manipulate the parent
directory of the chroot using some of the operations added in this

The safe solution is to perform all operations inside the chroot.
This will require extending the chroot socket protocol.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]