Re: DNS, SUID, Chroot

[Darren Reed <darrenr () cyber com au>]

In some mail I received from Marcus J. Ranum, sie wrote
> > 1. (Need to do as EUID ROOT) Open socket, bind to port, and do
> > 2. (Need to do as ROOT on some systems)
> >   do CHROOT to the jail area.
> > 3. SUID(harmless_user) (Need to do as ROOT)
>
> This is a good recipe, as long as you also stipulate that the jail
> contains no device files that would allow memory access, and no
> setuid files.
>
> It turns out there are 2 ways to get out of a chroot (if you're
> root):
>       -> you can use fchroot( ) -- a little advertised system call.

Requires open fd for a directory that you want to chroot to.  In most
cases, this would need to be the real "/", although chroot'ing to '/bin'
as root would let you subvert any of the binaries there.  Not a lot of
programs open a directory and leave it open, and even less open "/".
I looked at named (8.1.1) and it doesn't have any directories open once
it is ready and waiting.