ChrootDirectory security

[Alexander Prinsier]

Damien Miller wrote:
>> I can be sure that there are no setuid binaries in /home, so that rules
>> out some possible vulnerabilities. Could anyone tell me what other
>> problems a non-root-owned chroot directory could create?
> 
> Basically because having a non-root-user-writable root directory (i.e.
> what chroot(2) without a root-ownership test gives you) can be exploited
> through setuid programs, and because sshd has no way of determining 
> whether setuid programs exist in the chroot.

Thanks!

I'm going to have to modify sshd to remove this root-ownership-check
then. (I'm sure there are no setuid programs in /home, and never will be).

Any chance there would once be an option to turn this check off in the
config file?

Alexander