From owner-freebsd-hackers Sun Nov 15 07:37:37 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id HAA05106 for freebsd-hackers-outgoing; Sun, 15 Nov 1998 07:37:37 -0800 (PST) (envelope-from owner-freebsd-hackers@FreeBSD.ORG) Received: from alive.znep.com (207-178-54-226.go2net.com [207.178.54.226]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id HAA05101 for ; Sun, 15 Nov 1998 07:37:33 -0800 (PST) (envelope-from marcs@znep.com) Received: from localhost (marcs@localhost) by alive.znep.com (8.9.1/8.9.1) with ESMTP id HAA04682; Sun, 15 Nov 1998 07:32:01 -0800 (PST) (envelope-from marcs@znep.com) Date: Sun, 15 Nov 1998 07:32:01 -0800 (PST) From: Marc Slemko To: zhihuizhang cc: hackers Subject: Re: Question on chroot() In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sun, 15 Nov 1998, zhihuizhang wrote: > > I am quite confused with the usage of chroot(). It is said that chroot() > can only be performed by superuser and the chroot()'ed environment is > valid only for superuser that calls chroot() and its descendent (I assume > that a descendent inherits its parent's UID). > > However, a root can escape the environment withoud much difficulty. I > even find on the Web a page telling you how to break the chroot jail by > root. > > With these in mind, I can not figure out why the chroot() is really useful > to set up a ristricted access to a system and how a NORMAL user can be > setup to access only the chroot()'ed environment. I'm not sure if this is really freebsd-hackers material, but... Nothing stops root from switching to whatever other UID they want. So all you have to do is chroot(), then setuid() to some user before running whatever you want to run. It is also useful to provide isolated environments for cases where security isn't an issue, eg. build trees for things that do things relative to "/", etc. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message