But if, after chroot()'ing, "." acts differently for root than it does for every other user, then isn't root being treated as a special case? Mustn't there be a check against the uid somewhere? That's the special case I'm talking about.

It seems to me that you are saying, on Linux, in a chroot() environment, '.' is a special case for every user except root... I suppose you might look at it that way, but it seems a bit backward and I still don't understand where the reduction in code complexity comes from.

Regarding '..', I don't understand why that would be any more of a special case than it usually is (that is '/..' being equivalent to '/').

I'm sure I'll have to start digging through source code before I understand your point.

-sauoq
"My two cents aren't worth a dime.";

I believe the conflict in our understanding is in each of our understanding on where the /.. = /. = / magic is implemented. My understanding of the file system structures tells me that /.. = /. = / is implemented at mkfs time, not at run time. The '..' and '.' entries in '/' both refer to the same inode as '/' refers to. There is no special magic in the kernel.

It is possible that I am incorrect, however, I suggest to you that my understanding is the only understanding that explains why Linux allows users to escape a chroot() jail by referring to '.' and './..'.

UPDATE:

I think we are both wrong. I can't seem to escape the Linux chroot() jail in any of the ways listed above unless '.' was already outside the chroot() jail, which is the exploit that the man page refers to.

explains why Linux allows users to escape a chroot() jail

Ah, but Linux, AFAIK, doesn't allow just any user to escape the chroot() environment. It only allows the super-user to escape it.

I think we might be referring to two different special cases.

As for when /.. = /. = / is implemented, I wouldn't think it would happen during mkfs because mkfs would have no way of knowing whether the filesystem in question would be used as the root fs or not. (Might there be something going on when the root fs is mounted?) My understanding of this stuff is admittedly weak; I'd be happy to receive some enlightenment.

-sauoq
"My two cents aren't worth a dime.";