Process building package can escape from chroot and gain local root

[Karma Dorje]

Package: sbuild
Version: 0.62.6-1
Severity: important

When building a package with sbuild, the processes running in the chroot can escape from there and gain local root. This is possible as the processes in- and outside of the chroot environment run under the same user id and the outside process can run commands as root in the chroot environment.

[Jamie Strandboge (jdstrand)]

Thank you for reporting a bug in Ubuntu. I'm not following your reasoning. Chroots are not designed to provide a security barrier for root processes, so, like you say, a root process can break out. However, typical usage of sbuild is with schroot and packages that are built in the chroot should not be running as root. Therefore a user in the schroot should not be able to gain root in the manner described unless the chroot is misconfigured -- can you provide specifics? All that said, building untrusted packages means running untrusted code and a chroot should not necessarily be relied on for security (one can use snapshotted or throwaway virtual machines for this sort of thing).

[Seth Arnold (seth-arnold)]

I think what Karma was suggesting is that a process executing inside the schroot environment can use ptrace(2) to attach to a process outside the schroot environment. Such a process will probably have the ability to run:

schroot -c <foo> -u root <arbitrary root-level command>

Of course, on Ubuntu kernels, the ptrace(2) attachment will fail due to:

kernel.yama.ptrace_scope = 1

[Karma Dorje (taaroa)]

thanks for taking the time to explain everything.
should I mark this bug as invalid? i think so.