bugGNU Core Utilities - Bugs: bug #10384, chroot feature request: --user and...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #10384: chroot feature request: --user and --group parameters

Submitted by:  Chris Carpinello <chriscarpinello>
Submitted on:  Tue 14 Sep 2004 08:42:43 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Sat 02 May 2009 12:14:57 PM UTC, comment #5:

Here a new patch that adds the feature we discussed before. Now it is possible to specify a list of additional groups using -g/--groups.

(file #18074)

Giuseppe Scrivano <gscrivano>
Sat 02 May 2009 10:42:31 AM UTC, comment #4:

That's an option, certainly, and if the default is to remove supplementary groups, it's pretty safe.

Another option is to call getgroups(), but then you need to decide whether to call it before chroot (when things like any necessary LDAP config files are around) or after the chroot (since perhaps the chroot environment contains a different /etc/groups file).

In general this problem doesn't arise for people who do

chroot /blah /bin/su - fred

because while su picks up the group configuration somewhere in /blah, it's also linked against the libraries in /blah which presumably know how to handle it.

Hence I think something like your suggestion is probably the best choice even though some users might prefer the groups to be selected automatically.

I'm not sure about the user-interface choice of specifying group information in two places (the rhs of --userspec and also in --groups) but I can't think right now of a solution which is both sufficiently general and actually better. For example, saying --userspec=user:egid,group2,group3 seems initially reasonable but (a) doesn't allow the user to specify a configuration where the egid is not in the supplementary group list and (b) probably isn't supported by the parsing function you called.

Therefore I think I'm voting for your "--groups" suggestion.

James Youngman <jay>
Sat 02 May 2009 10:17:42 AM UTC, comment #3:

what do you think about adding another argument --groups=g1,g2,...,gn? When it is specified supplementary groups are setted to the specified ones, if it is not specified then the original ones are kept.

Giuseppe Scrivano <gscrivano>
Sat 02 May 2009 10:05:09 AM UTC, comment #2:

What about supplementary group IDs? In the general case the caller will be privileged and want to drop those privileges. Some of the supplementary groups will be privileged.

James Youngman <jay>
Fri 01 May 2009 09:53:22 PM UTC, comment #1:

In the attached patch I added the possibility to specify an user:group.

`choot --userspec=user:group /foo/bar`

The patch uses the gnulib userspec module.

What do you think about it?

(file #18071)

Giuseppe Scrivano <gscrivano>
Tue 14 Sep 2004 08:42:43 PM UTC, original submission:

Add support for --user and --group parameters that setuid/seteuid and setgid/setegid respectively after the chroot() is performed.

Chris Carpinello <chriscarpinello>

 

Attached Files
file #18074:  chroot_userspec.diff added by gscrivano (4kB - text/x-diff)
file #18071:  chroot_userspec.diff added by gscrivano (3kB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Posted a comment)
  • -unavailable- added by gscrivano (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 02 May 2009 12:14:57 PM UTCgscrivanoAttached File-=>Added chroot_userspec.diff, #18074
    Fri 01 May 2009 09:53:22 PM UTCgscrivanoAttached File-=>Added chroot_userspec.diff, #18071

    Back to the top


    Powered by Savane 3.1-cleanup