Hi Damien,

On Fri, 24 Oct 2008, Damien Miller wrote:
> On Fri, 24 Oct 2008, Peter Stuge wrote:
> > Teemu Ikonen wrote:
> >
> > > or even better, could a 'chrootdir' option be added to the
> > > Authorized keys format?

> >
> > Yes. I think this will be the easiest to implement. Give it a shot.
> > Infrastructure is in place also for passing a value from options in
> > authorized_keys.

>
> No, letting users chroot to arbitrary directories introduces
> serious security problems. Think about hard-linking /bin/su into
> a chroot on the same filesystem where an attacker has filled in
> a friendly /etc/passwd.


I thought that the suid bit was a property of the directory entry, not the
inode? On what platforms is the suid bit a property of the inode, which
would make this exploit possible?

Cheers, Chris.
--
_____ __ _
\ __/ / ,__(_)_ | Chris Wilson <0000 at qwirx.com> - Cambs UK |
/ (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Ruby/Perl/SQL Developer |
\ _/_/_/_//_/___/ | Stop nuclear war http://www.nuclearrisk.org |
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev