diff options
author | Bernhard Voelker <mail@bernhard-voelker.de> | 2014-08-01 02:07:33 +0200 |
---|---|---|
committer | Bernhard Voelker <mail@bernhard-voelker.de> | 2014-08-01 12:35:05 +0200 |
commit | 0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379 (patch) | |
tree | 8fbc26f179a41417cb41a232db261d8f1ac0acd6 /doc | |
parent | 0cf66cbe85009213bcf2608eceeee1355f367667 (diff) | |
download | coreutils-0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379.tar.xz |
chroot: perform chdir("/") again unless new --skip-chdir is specified
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms). The problem is that it also skips
the following chdir("/") call in that case. The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.
cd /home/user && chroot '/' bin/foo
In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.
Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified. Restrict this new option to the case of "/" arguments.
* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified. Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.
Reported by Andreas Schwab in http://bugs.gnu.org/18062
Diffstat (limited to 'doc')
-rw-r--r-- | doc/coreutils.texi | 36 |
1 files changed, 24 insertions, 12 deletions
diff --git a/doc/coreutils.texi b/doc/coreutils.texi index 96f07816f..7c8671971 100644 --- a/doc/coreutils.texi +++ b/doc/coreutils.texi @@ -16113,7 +16113,10 @@ On many systems, only the super-user can do this.@footnote{However, some systems (e.g., FreeBSD) can be configured to allow certain regular users to use the @code{chroot} system call, and hence to run this program. Also, on Cygwin, anyone can run the @command{chroot} command, because the -underlying function is non-privileged due to lack of support in MS-Windows.} +underlying function is non-privileged due to lack of support in MS-Windows. +Furthermore, the @command{chroot} command avoids the @code{chroot} system call +when @var{newroot} is identical to the old @file{/} directory for consistency +with systems where this is allowed for non-privileged users.}. Synopses: @example @@ -16123,10 +16126,11 @@ chroot @var{option} Ordinarily, file names are looked up starting at the root of the directory structure, i.e., @file{/}. @command{chroot} changes the root to -the directory @var{newroot} (which must exist) and then runs -@var{command} with optional @var{args}. If @var{command} is not -specified, the default is the value of the @env{SHELL} environment -variable or @command{/bin/sh} if not set, invoked with the @option{-i} option. +the directory @var{newroot} (which must exist), then changes the working +directory to @file{/}, and finally runs @var{command} with optional @var{args}. +If @var{command} is not specified, the default is the value of the @env{SHELL} +environment variable or @command{/bin/sh} if not set, invoked with the +@option{-i} option. @var{command} must not be a special built-in utility (@pxref{Special built-in utilities}). @@ -16135,6 +16139,14 @@ Options must precede operands. @table @samp +@item --groups=@var{groups} +@opindex --groups +Use this option to override the supplementary @var{groups} to be +used by the new process. +The items in the list (names or numeric IDs) must be separated by commas. +Use @samp{--groups=''} to disable the supplementary group look-up +implicit in the @option{--userspec} option. + @item --userspec=@var{user}[:@var{group}] @opindex --userspec By default, @var{command} is run with the same credentials @@ -16145,13 +16157,13 @@ If a @var{user} is specified then the supplementary groups are set according to the system defined list for that user, unless overridden with the @option{--groups} option. -@item --groups=@var{groups} -@opindex --groups -Use this option to override the supplementary @var{groups} to be -used by the new process. -The items in the list (names or numeric IDs) must be separated by commas. -Use @samp{--groups=''} to disable the supplementary group look-up -implicit in the @option{--userspec} option. +@item --skip-chdir +@opindex --skip-chdir +Use this option to not change the working directory to @file{/} after changing +the root directory to @var{newroot}, i.e., inside the chroot. +This option is only permitted when @var{newroot} is the old @file{/} directory, +and therefore is mostly useful together with the @option{--groups} and +@option{--userspec} options to retain the previous working directory. @end table |