Haque, Afzal and Ayyar, Amrit and Singh, Sanjay (2018) Chroot Hardening through System Calls Modification. In: International Conference on Cloud Computing, Data Science & Engineering, 11/01/2018, Amity University, Noida, India.

PDF 1170.pdf - Published Version Restricted to Registered users only Download (110kB) | Request a copy

Abstract

The chroot system call implemented in Unix-like (or *nix) OSes changes a view of the file structure for the calling process and its children by changing the root directory for them. It was intended as an administrative tool and not a security one and the Linux implementation follows the Portable Operating System Interface (POSIX) standards. However, it is used as a security tool extensively. Difference in intended use and actual use of chroot in Linux implementation has resulted in labeling of some features as security vulnerabilities. Vulnerabilities could allow malicious users to completely circumvent the security aspect of chroot. The methods used in this paper removes the cause of those vulnerabilities which results in a more secure construct. Some of those are: not changing of the Current Working Directory (CWD), not closing file descriptors and allowing mounting of file systems inside the newly created environment. In this paper we try to address these specific issues by modifying the system calls in the system call table and more generally, present a solution with a good design. The proposed solutions aims to improve the design of chroot when used as a security construct

Item Type:	Conference or Workshop Item (Paper)
Uncontrolled Keywords:	Chroot, Linux kernel
Subjects:	Engineering > MIT Manipal > Information and Communication Technology
Depositing User:	MIT Library
Date Deposited:	19 Oct 2018 08:54
Last Modified:	19 Oct 2018 08:54
URI:	http://eprints.manipal.edu/id/eprint/152142

Actions (login required)

View Item