Chroot Hardening Through System Calls Modification

Afzalul Haque, Amrit Ayyar, Sanjay Singh

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

The chroot system call implemented in Unix-like (or∗nix) OSes changes a view of the file structure for the calling process and its children by changing the root directory for them. It was intended as an administrative tool and not a security one and the Linux implementation follows the Portable Operating System Interface (POSIX) standards. However, it is used as a security tool extensively. Difference in intended use and actual use of chroot in Linux implementation has resulted in labeling of some features as security vulnerabilities. Vulnerabilities could allow malicious users to completely circumvent the security aspect of chroot. The methods used in this paper removes the cause of those vulnerabilities which results in a more secure construct. Some of those are: not changing of the Current Working Directory (CWD), not closing file descriptors and allowing mounting of file systems inside the newly created environment. In this paper we try to address these specific issues by modifying the system calls in the system call table and more generally, present a solution with a good design. The proposed solutions aims to improve the design of chroot when used as a security construct.

Original languageEnglish
Title of host publicationProceedings of the 8th International Conference Confluence 2018 on Cloud Computing, Data Science and Engineering, Confluence 2018
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages491-496
Number of pages6
ISBN (Print)9781538617182
DOIs
Publication statusPublished - 20-08-2018
Event8th International Conference Confluence on Cloud Computing, Data Science and Engineering, Confluence 2018 - Noida, Uttar Pradesh, India
Duration: 11-01-201812-01-2018

Publication series

NameProceedings of the 8th International Conference Confluence 2018 on Cloud Computing, Data Science and Engineering, Confluence 2018

Conference

Conference8th International Conference Confluence on Cloud Computing, Data Science and Engineering, Confluence 2018
Country/TerritoryIndia
CityNoida, Uttar Pradesh
Period11-01-1812-01-18

All Science Journal Classification (ASJC) codes

  • Modelling and Simulation
  • Health Informatics
  • Artificial Intelligence
  • Computer Networks and Communications
  • Information Systems and Management
  • Safety, Risk, Reliability and Quality

Fingerprint

Dive into the research topics of 'Chroot Hardening Through System Calls Modification'. Together they form a unique fingerprint.

Cite this