[Bug 213135] CVE-2008-2544 mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw

[bugzilla at redhat.com]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.


https://bugzilla.redhat.com/show_bug.cgi?id=213135





--- Comment #22 from Tomas Hoger <thoger at redhat.com>  2009-01-13 03:03:00 EDT ---
(In reply to comment #21)
> 2) of course a read-write mounted /chroot/proc will instantly turn security
> into a joke (as all processes, files and devices are accessible by anybody
> becoming root in the chroot).  But most of these applications, while requiring
> a /proc, can live with a readonly /proc.

If anybody in the chroot becomes root, she can escape chroot trivially without
/proc mounted at all.  Read-only vs. read-write /proc mount does not influence
that much.

> I strongly urge somebody who is running a recent Fedora to re-open this bug
> report after confirming which behavior it is showing now.

Has this been fixed, or is this test incorrect?

# uname -r
2.6.27.9-159.fc10.x86_64

# mkdir -p /chroot/proc

# mount -o ro -t proc proc /chroot/proc/

# cat /proc/mounts | grep '/proc proc'
/proc /proc proc rw 0 0
proc /chroot/proc proc ro 0 0

# echo 1 > /proc/sys/net/ipv4/ip_forward

# echo 1 > /chroot/proc/sys/net/ipv4/ip_forward
bash: /chroot/proc/sys/net/ipv4/ip_forward: Read-only file system

-- 
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.