bugGNU Core Utilities - Bugs: bug #10384, chroot feature request: --user and...


You are not allowed to post comments on this tracker with your current authentication level.

bug #10384: chroot feature request: --user and --group parameters

Submitted by:  Chris Carpinello <chriscarpinello>
Submitted on:  Tue 14 Sep 2004 08:42:43 PM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

( Jump to the original submission)

Fri 06 Feb 2015 07:37:46 AM UTC, comment #6:

The feature is available since v7.5, i.e., ~6 years now; thus closing.

Bernhard Voelker <berny>
Project Member
Sat 02 May 2009 12:14:57 PM UTC, comment #5:

Here a new patch that adds the feature we discussed before. Now it is possible to specify a list of additional groups using -g/--groups.

(file #18074)

Giuseppe Scrivano <gscrivano>
Sat 02 May 2009 10:42:31 AM UTC, comment #4:

That's an option, certainly, and if the default is to remove supplementary groups, it's pretty safe.

Another option is to call getgroups(), but then you need to decide whether to call it before chroot (when things like any necessary LDAP config files are around) or after the chroot (since perhaps the chroot environment contains a different /etc/groups file).

In general this problem doesn't arise for people who do

chroot /blah /bin/su - fred

because while su picks up the group configuration somewhere in /blah, it's also linked against the libraries in /blah which presumably know how to handle it.

Hence I think something like your suggestion is probably the best choice even though some users might prefer the groups to be selected automatically.

I'm not sure about the user-interface choice of specifying group information in two places (the rhs of --userspec and also in --groups) but I can't think right now of a solution which is both sufficiently general and actually better. For example, saying --userspec=user:egid,group2,group3 seems initially reasonable but (a) doesn't allow the user to specify a configuration where the egid is not in the supplementary group list and (b) probably isn't supported by the parsing function you called.

Therefore I think I'm voting for your "--groups" suggestion.

James Youngman <jay>
Sat 02 May 2009 10:17:42 AM UTC, comment #3:

what do you think about adding another argument --groups=g1,g2,...,gn? When it is specified supplementary groups are setted to the specified ones, if it is not specified then the original ones are kept.

Giuseppe Scrivano <gscrivano>
Sat 02 May 2009 10:05:09 AM UTC, comment #2:

What about supplementary group IDs? In the general case the caller will be privileged and want to drop those privileges. Some of the supplementary groups will be privileged.

James Youngman <jay>
Fri 01 May 2009 09:53:22 PM UTC, comment #1:

In the attached patch I added the possibility to specify an user:group.

`choot --userspec=user:group /foo/bar`

The patch uses the gnulib userspec module.

What do you think about it?

(file #18071)

Giuseppe Scrivano <gscrivano>
Tue 14 Sep 2004 08:42:43 PM UTC, original submission:

Add support for --user and --group parameters that setuid/seteuid and setgid/setegid respectively after the chroot() is performed.

Chris Carpinello <chriscarpinello>


Attached Files
file #18074:  chroot_userspec.diff added by gscrivano (4KiB - text/x-diff)
file #18071:  chroot_userspec.diff added by gscrivano (3KiB - text/x-diff)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by berny (Posted a comment)
  • -email is unavailable- added by jay (Posted a comment)
  • -email is unavailable- added by gscrivano (Updated the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-02-06 berny StatusNone => Fixed
        Open/ClosedOpen => Closed
    2009-05-02 gscrivano Attached File- => Added chroot_userspec.diff, #18074
    2009-05-01 gscrivano Attached File- => Added chroot_userspec.diff, #18071

    Back to the top

    Powered by Savane 3.3