bugGNU Core Utilities - Bugs: bug #10384, chroot feature request: --user and...


You are not allowed to post comments on this tracker with your current authentication level.

bug #10384: chroot feature request: --user and --group parameters

Submitted by:  Chris Carpinello <chriscarpinello>
Submitted on:  Tue Sep 14 20:42:43 2004  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

(Jump to the original submission Jump to the original submission)

Fri Feb 6 07:37:46 2015, comment #6:

The feature is available since v7.5, i.e., ~6 years now; thus closing.

Bernhard Voelker <berny>
Project Member
Sat May 2 12:14:57 2009, comment #5:

Here a new patch that adds the feature we discussed before. Now it is possible to specify a list of additional groups using -g/--groups.

(file #18074)

Giuseppe Scrivano <gscrivano>
Sat May 2 10:42:31 2009, comment #4:

That's an option, certainly, and if the default is to remove supplementary groups, it's pretty safe.

Another option is to call getgroups(), but then you need to decide whether to call it before chroot (when things like any necessary LDAP config files are around) or after the chroot (since perhaps the chroot environment contains a different /etc/groups file).

In general this problem doesn't arise for people who do

chroot /blah /bin/su - fred

because while su picks up the group configuration somewhere in /blah, it's also linked against the libraries in /blah which presumably know how to handle it.

Hence I think something like your suggestion is probably the best choice even though some users might prefer the groups to be selected automatically.

I'm not sure about the user-interface choice of specifying group information in two places (the rhs of --userspec and also in --groups) but I can't think right now of a solution which is both sufficiently general and actually better. For example, saying --userspec=user:egid,group2,group3 seems initially reasonable but (a) doesn't allow the user to specify a configuration where the egid is not in the supplementary group list and (b) probably isn't supported by the parsing function you called.

Therefore I think I'm voting for your "--groups" suggestion.

James Youngman <jay>
Sat May 2 10:17:42 2009, comment #3:

what do you think about adding another argument --groups=g1,g2,...,gn? When it is specified supplementary groups are setted to the specified ones, if it is not specified then the original ones are kept.

Giuseppe Scrivano <gscrivano>
Sat May 2 10:05:09 2009, comment #2:

What about supplementary group IDs? In the general case the caller will be privileged and want to drop those privileges. Some of the supplementary groups will be privileged.

James Youngman <jay>
Fri May 1 21:53:22 2009, comment #1:

In the attached patch I added the possibility to specify an user:group.

`choot --userspec=user:group /foo/bar`

The patch uses the gnulib userspec module.

What do you think about it?

(file #18071)

Giuseppe Scrivano <gscrivano>
Tue Sep 14 20:42:43 2004, original submission:

Add support for --user and --group parameters that setuid/seteuid and setgid/setegid respectively after the chroot() is performed.

Chris Carpinello <chriscarpinello>


Attached Files
file #18074:  chroot_userspec.diff added by gscrivano (4kB - text/x-diff)
file #18071:  chroot_userspec.diff added by gscrivano (3kB - text/x-diff)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by berny (Posted a comment)
  • -unavailable- added by jay (Posted a comment)
  • -unavailable- added by gscrivano (Updated the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri Feb 6 07:37:46 2015bernyStatusNone=>Fixed
    Sat May 2 12:14:57 2009gscrivanoAttached File-=>Added chroot_userspec.diff, #18074
    Fri May 1 21:53:22 2009gscrivanoAttached File-=>Added chroot_userspec.diff, #18071

    Back to the top

    Powered by Savane 3.1-cleanup1