Firewall Wizards: Re: chroot useful?

[Aleph One <aleph1 () dfw net>]

On Fri, 14 Nov 1997, Steven M. Bellovin wrote:

> That was precisely my point -- that this opinion is not correct.  There
> are numerous ways for root to break out of a chroot() "jail"; the simplest
> is to do mknod() to create new special device files for the real disks, and
> mount new file systems on those devices.  Many other variants are possible
> as well.
Actually the simplest is:

mkdir("foo",S_IRUSR|S_IXUSR);
chroot("foo");
chdir("..");

Aleph One / aleph1 () dfw net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01