10 ms·
I've never seen this advice, would you mind elaborating or citing a more elaborate source? Since pivot_root requires the old root to be a child of the new root
by bluecmd 7y ago
I've never seen this advice, would you mind elaborating or citing a more elaborate source?
Since pivot_root requires the old root to be a child of the new root, traversing back to the full system seems trivial. Actually, I don't see why this syscall isn't worse than chroot due to this.
- ece 7y agogrsec doesn't use pivot_root, you can read into that however much you'd like: https://en.wikipedia.org/wiki/Grsecurity#Chroot_restrictions https://en.wikipedia.org/wiki/Grsecurity#Chroot_restrictions
- cyphar 7y ago> Actually, I don't see why this syscall isn't worse than chroot due to this. You can (and everyone does) unmount the oldroot. Then in your mount namespace the old root is not reachable through the VFS alone. You need to make use of procfs's magic-links or other such tricks.