[uml-user] privilege escalation?

[Frank 'x. F. <xr...@rw...>]

Hi List!

I built UML from 2.6.10 sources with no additional uml-specific patches.
My Host is also 2.6.10 with skas. I discovered that when (my) uml is running
as root _every_ user-id inside the uml may chmod _every_ file on a hostfs mount
and therfore become root etc...
This also happens if the hostfs mount is not the root-fs.

Is the following behaviour desired? If not: what could cause it?

xraz@net3:~$ grep root /proc/mounts 
rootfs / rootfs rw 0 0
/dev/root / hostfs rw 0 0

xraz@net3:~$ id
uid=1000(xraz) gid=104(xraz) groups=104(xraz),9997(chefs)

xraz@net3:~$ ls -la /bin/dash 
- -rwxr-xr-x  1 root root 83960 Aug 22 20:28 /bin/dash

xraz@net3:~$ chmod 4755 /bin/dash 

xraz@net3:~$ ls -la /bin/dash 
- -rwsr-xr-x  1 root root 83960 Aug 22 20:28 /bin/dash

xraz@net3:~$ /bin/dash -c id
uid=1000(xraz) gid=104(xraz) euid=0(root) groups=104(xraz),9997(chefs)


What is going wrong?
Because i suppose this is a local error and not an uml-bug i don't yet include
debuginfo about my uml & system here.

        ...Frank

-- 
"...um das Hassen zu hasssen, und aus Prinzip keins zu haben"
Fingerprint: 6CF4 0AE0 021C E9A6 62DD C248 B745 4446 B703 B7F0
-> /xraz.de/gpg.key