chroot jail: can't run as non-root?

From: Reuben D. Budiardja (techlist_at_voyager.phys.utk.edu)
Date: 10/31/03 

To: redhat-list@redhat.com
Date: Fri, 31 Oct 2003 16:18:57 -0500

Hi,
I'm a bit confused. I am trying to use chroot to run some services, in effect
creating a root jail. I put all the necessary share libs in the new root
directory.
All the reading I did suggest that I don't run service as root, as it may be
possible to break out of the root jail if it's run as root. But, chroot
command cannot be run if I'm not root, can it? So how do I do this?

So far, I've done:
root $> chroot /home/service /bin/bash

Then in the new root dir
sh $> ./service_name

does that mean the service run as root? How do I avoid that since "chroot"
needs to be run as root? Does anyone know any program that make something
like this easier, so that I don't need to manually track all the necessary
share libs that the service use and put them under the new root directory ?

I've googled this, but have not hit anything that could help me. Most of the
stuff I got is too general.

Any help is appreciated. Thanks.

Reuben D. Budiardja 

-- 
Reuben D. Budiardja
Department of Physics and Astronomy
The University of Tennessee, Knoxville, TN
---------------------------------------------------------
"To be a nemesis, you have to actively try to destroy 
something, don't you? Really, I'm not out to destroy 
Microsoft. That will just be a completely unintentional 
side effect."
                 - Linus Torvalds -
-- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

Relevant Pages

  • Re: sys_chroot+sys_fchdir Fix
    ... I don't hope to secure Linux ... within chroot, simply to fix chroot so that it does what it says it ... new root, dot-dot is promised to keep you within that root; ... So the OpenBSD man page seems to be in the minority here. ...
    (Linux-Kernel)
  • Re: chroot?
    ... > communications link and am setting up chroot for this ... Does it need to be suid root? ... To execute chroot, either the function or the command, ... you need any dynamic libs used by that program. ...
    (comp.unix.aix)
  • Chroot bug take 3
    ... Posit a normal process having some filesystem root, and a current working directory (pwd) lying within that root subtree. ... It is perfectly reasonable for a process to execute chroot multiple times, each time pruning off access to further parts of the filesystem. ...
    (Linux-Kernel)
  • Re: Mandrake 8.1 Desktop Gone
    ... Read the man page for the FTP server and look for the ... Use chmod to remove "others" access to all directories in root. ... setting it up in a chroot jail. ... chroot - run command or interactive shell with special root directory ...
    (alt.os.linux)
  • Re: SATA drive probs: Knoppix OK, but nothing else
    ... Don't forget to also mount /boot if it's not on ... The rationale for the chroot before running lilo is that it works ... Knoppix is usually a bit newer than Debian ... root for my admin. ...
    (Debian-User)