Details

Reviewers

kevans
kib

Commits

rG95f8c3e1ed0c: chroot.2: Update errors and unprivileged use

Summary

Include errors common to chroot and fchroot in a single list, followed
by errors unique to each.

Unprivileged chroot is permitted if the security.bsd.unprivileged_chroot
sysctl is set to 1.  Make note of this and update the EPERM description.

Reported by:    kevans

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

emaste created this revision.Sat, Aug 2, 5:19 PM

Herald added a subscriber: ziaee. · View Herald TranscriptSat, Aug 2, 5:19 PM

emaste requested review of this revision.Sat, Aug 2, 5:19 PM

emaste mentioned this in D51702: kernel: Allow unprivileged chroot by default.

kevans added inline comments.Sat, Aug 2, 5:35 PM

lib/libsys/chroot.2
66	I'd recommend noting the procctl(2) requirement as well- maybe this?

allanjude added a subscriber: allanjude.Sat, Aug 2, 5:42 PM

allanjude added inline comments.

lib/libsys/chroot.2
66	Is it meant to say you can't chroot if the process has enabled NO_NEW_PRIVS? or something else?

emaste updated this revision to Diff 159644.Sat, Aug 2, 5:42 PM

emaste retitled this revision from chroot.2: Note that unprivileged use is possible to chroot.2: Update errors and unprivileged use.

emaste edited the summary of this revision. (Show Details)

kevans added inline comments.Sat, Aug 2, 5:45 PM

lib/libsys/chroot.2
66	NO_NEW_PRIVS is the mechanism that blocks suid/sgid, so it must be toggled on before you can chroot(2) as non-root

update with @kevans feedback

Thanks!

This revision is now accepted and ready to land.Sat, Aug 2, 5:57 PM

kib added inline comments.Sat, Aug 2, 6:00 PM

lib/libsys/chroot.2
117–118	Which component?

emaste added inline comments.Sat, Aug 2, 6:06 PM

lib/libsys/chroot.2
117–118	This is pretty standard wording for ENOTDIR among other system calls, any component of the path name for chroot(2). Did combining them into one list make it confusing? I can use `ENOTDIR A component of the path name is not a directory.` for chroot and `ENOTDIR The file descriptor does not reference a directory.` for fchroot.