grsecurity forums

I see alot of nifty chroot restrictions, like refusing mount, mknod etc, but I thought those would require root inside the jail anyway, does this mean you can't break out of a grsec-chroot even if you have root?

incognito_ wrote:I see alot of nifty chroot restrictions, like refusing mount, mknod etc, but I thought those would require root inside the jail anyway, does this mean you can't break out of a grsec-chroot even if you have root?

yes, that's the whole point. whether there're still holes left is hard to tell, but it's certainly better than what other systems provide (spender wrote an article on this topic for the french MISC magazine last year).