OpenOrbis / mira-project

mira rewrite in cxx
GNU General Public License v3.0
294 stars 63 forks source link

[feature request] chroot escape #135

Open sleirsgoevy opened 4 years ago

sleirsgoevy commented 4 years ago

There seems to be no way to set fd_rdir and fd_jdir via /dev/mira ioctls, which is required in utility apps for accessing PS4 filesystem.

OsirizX commented 3 years ago

I suggest setting it to rootvnode if the request to set prison is root. It works well in my tests.

// CtrlDriver.cpp
// CtrlDriver::SetThreadCredentials
auto l_ThreadCredential = l_Thread->td_ucred;
auto l_ThreadFd = l_Thread->td_proc->p_fd;
...
if (p_Input.Prison == MiraThreadCredentials::_MiraThreadCredentialsPrison::Root) {
    l_ThreadCredential->cr_prison = *(struct prison**)kdlsym(prison0);
    l_ThreadFd->fd_rdir = l_ThreadFd->fd_jdir = *(struct vnode**)kdlsym(rootvnode);
}