Programming Perl, 4th Edition

Changing Root

Perl’s chroot works just like the chroot(2) system call. It changes the root directory, so your program can’t access any files outside of the section of the filesystem that you intend to use. However, only the root user gets to do this, so already that’s a security issue:

chroot( '/usr/local/apache/data' );
chdir( '/' );   # now in /usr/local/apache/data

This doesn’t actually prevent access outside of the new root. A directory handle opened prior to the chroot can crawl back up to the real root, even though you can’t use a filename:

use v5.14;
use warnings;

say "Here I am";

opendir my $rootdh, '/';

chroot( '/Users/Amelia' );
opendir my $dh, '/';  # /Users/Amelia
say for readdir($dh);

chdir( $rootdh );     # oops, back to the real '/'
opendir my $dh, '.';
say for readdir($dh);

This relies on you, or someone else, allowing this situation to happen. If someone can edit the program to insert this naughtiness, no level of Perl security is going to help. Use any trick you can find to avoid a root user Perl program.