Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was reading description about setuid on wikipedia http://en.wikipedia.org/wiki/Setuid

I was unable to understand how chroot is related to setuid as mention in following paragraph from wikipedia

The presence of setuid executables explains why the chroot system call is not available to non-root users on Unix. See limitations of chroot for more details.

share|improve this question

1 Answer 1

up vote 10 down vote accepted

If a non-privileged user could execute a setuid program in a chroot jail, they could carefully construct that jail to trick the program into escalating privileges. For example, I can construct a chroot jail in which I'm permitted to use sudo, because I can control every configuration file inside that jail.

share|improve this answer
    
I still totally think that the expression on the wikipedia page could be rewritten to actually express this. –  Florin Asavoaie Apr 17 at 7:51
    
The limitations section of the article on chroot goes into more detail, as the excerpt says. –  David Schwartz Apr 17 at 7:52
6  
@FlorinAsavoaie: The nice thing on wikipedia is that if you think "it could be written this and that", you are entitled to do so :) –  phresnel Apr 17 at 12:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.