chroot(2) unavailable to unprivileged users?
I don't understand existing answers on the Internet. For example this one https://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123.html.
sudo really work if
/etc were not owned by root? An unprivileged user can't just create root owned setuid binaries inside chroot, can she?
Exactly how can an unprivileged user subvert the chroot environment?
I can only think of something like that
ln /mnt/backup/XYZ/etc/sudoers $CHROOT/etc/sudoers ln /usr/bin/sudo $CHROOT/usr/bin/sudo
XYZ denotes some backup instance where admin really screwed up and allowed my user something dangerous. But this is kinda special. Is there any more straightforward way to exploit
chroot(2) if it was available to unprivileged users?