If you need root to set up the escape, then yes that is relatively uninteresting. Like, we know chroot can't contain root.

▲

3form 5 hours ago | parent [-]

Thanks. It was not evident from the example whether root inside of the sandbox is necessary - I assumed creating arbitrary symlinks doesn't require any particular capabilities, and there's nothing special about the locations.

Though it's not clear to me now:

- why was this patched then?

- is the point about root that non-root wouldn't have access to passwd anyway?

▲

ori_b 3 hours ago | parent [-]

OpenBSD doesn't have separate user accounts for sandboxes. These sandboxes are not linux-style containers, they're narrowed views of the full install.

If you're root inside the sandbox, you're root outside it. This exploit requires you to already be root.

▲

3form an hour ago | parent [-]

But the issue of root and accessing outside of the sandbox is orthogonal, no? Even if you're logged in as XYZ, accessing XYZ's contents outside of the sandbox is still a breach and a problem. Or does this issue require actual root to manifest?

	▲	ori_b 38 minutes ago \| parent [-]
		This path was special cased used to allow restricted applications to access time zone files, which are needed for time functions. Not any symlink will do, it has to be the specific one shown in the example exploit. The place this symlink lives is owned by root. This is the same root user outside the sandbox as inside it. So, yes, you need to have root on the box to set up this exploit.