question about chroot restrictions

[incognito_]

I see alot of nifty chroot restrictions, like refusing mount, mknod etc, but I thought those would require root inside the jail anyway, does this mean you can't break out of a grsec-chroot even if you have root?

[PaX Team]

I see alot of nifty chroot restrictions, like refusing mount, mknod etc, but I thought those would require root inside the jail anyway, does this mean you can't break out of a grsec-chroot even if you have root?

yes, that's the whole point. whether there're still holes left is hard to tell, but it's certainly better than what other systems provide (spender wrote an article on this topic for the french MISC magazine last year).