Chroot jail environment puzzle Post: 302470431

Sponsored Content

Top Forums UNIX for Advanced & Expert Users Chroot jail environment puzzle Post 302470431 by john.english on Wednesday 10th of November 2010 06:04:59 AM

11-10-2010

Registered User

Chroot jail environment puzzle

I have a simple sandbox program which runs a command as user "nobody" in a chroot jail. It sets resource limits with setrlimit, changes the user id with setuid, changes the root dir with chroot, and then calls exec to execute the command given as command line parameters. It is of course a setuid root program so that the call to chroot will work. FWIW, this is on a 64-bit machine running the latest Fedora.

It works fine when running as root; I can do things like:

Code:

   export FOO=bar
   export LD_LIBRARY_PATH=xxx
   export PATH=yyy:$PATH
   /usr/bin/printenv
   sandbox /myjail /usr/bin/printenv

(there is of course a copy of /usr/bin/printenv inside /myjail) and the environment outside the sandbox is exactly the same as inside.

Running it as a normal user, the environment outside the sandbox contains FOO, LD_LIBRARY_PATH, the modified PATH, and other things such as USER, HOME and NLSPATH. Inside the sandbox the environment is the same except that LD_LIBRARY_PATH and NLSPATH are missing!

I cannot for the life of me see why it should victimise these two variables and yet leave the rest of the environment. Can anyone help explain this puzzling behaviour?

TIA...

john.english

View Public Profile for john.english

Find all posts by john.english

9 More Discussions You Might Find Interesting

1. AIX

chroot environment

Hi!! I'm currently running AIX 4.3.3 and i'm trying to setup a chroot environment for the users who use SFTP, i spend a lot time SFTW but i can't make it work. I got openssh3.9p1 whit the chroot patch. Any help is greatly appreciated.

2. Shell Programming and Scripting

Alias escape puzzle

Here is "escape puzzle" from real life task: Conditions: We need to create an alias which will Save current directory path Will ssh to particular server Then will cd to saved path (it's mounted via NFS) Then will find all files with name patter as "All*.bld" and run particular editor...

3. Linux

It's a puzzle

Hi, Recently I installed Fedora 9 on the following hardware - Asus A8N-SLI Deluxe motherboard bios version 1805 - 2GB twinmos ram - AMD 4400 CPU - Tagan PSU 550 W - Asus EN6200LE video card - WD 74 GB Raptor - Areca ARC-1222 raid controller - 4x 1TB Seagate Baracudas - Symbios Logic...

4. UNIX for Dummies Questions & Answers

How to start a chroot jail?

I was reading an article on how it is very important to setup a chroot jail to run bind. I can follow what the article says but one thing I am unclear about is now on system boot the BIND process in the chroot jail will start since it the owner will no longer be root but some other user. Can...

5. IP Networking

Puzzle about sctp_bindx in UNP

It writes in Section 9.3 in Unix Network programming about SCTP: "The sctp_bindx call can be used on a bound or unbound socket." And then it writes: "The port number in all the socket address structures must be the same and must match any port number that is already bound; if it doesn't, then...

6. Debian

SSH chroot jail problems

Firstly Hi everyone :) I setup SFTP and SSH jail using this tutorial: http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny SFTP jail works however now when I try to SSH it accepts my password and then just goes to a blank screen. Type any command and the shell session is...

7. Solaris

Swap puzzle

I'm getting confused by swap # swap -l swapfile dev swaplo blocks free /dev/zvol/dsk/rpool/swap 256,2 16 16777200 16777200 /dev/zvol/dsk/swappool/swap2 256,1 16 50331632 50331632 # swap -s total: 6710256k bytes allocated + 3402944k reserved = 10113200k used,...

8. UNIX for Dummies Questions & Answers

Creating chroot environment with an ISO file.

I decided to try creating a chroot environment with a BT5r2 iso file. I'm just wanting to run Backtrack from inside Debian without having to reboot into my other partition or use vmware. I found some documentation on how to do this with BT4 at this link: ...

9. Red Hat

sftp jail chroot env setup

Hi I need a specific user to be able to sftp to a server and get files from a specific location. The location is not the users home dir, i don't want the user to be able to view anything else apart from the files in that area. e.g ftp file are is - /logging/phplogs e.g user home is...

LEARN ABOUT NETBSD

chroot

CHROOT(8)						    BSD System Manager's Manual 						 CHROOT(8)

NAME

     chroot -- change root directory

SYNOPSIS

     chroot [-G group,group,...] [-g group] [-u user] newroot [command]

DESCRIPTION

     The chroot command changes its root directory to the supplied directory newroot and exec's command, or, if not supplied, an interactive copy
     of your shell.

     If the -u, -g, or -G options are given, the user, group, and group list of the process are set to these values after the chroot has taken
     place; see setgid(2), setgroups(2), setuid(2), getgrnam(3), and getpwnam(3).

     Note: command or the shell are run as your real-user-id.

ENVIRONMENT

     The following environment variable is referenced by chroot:

     SHELL  If set, the string specified by SHELL is interpreted as the name of the shell to exec.  If the variable SHELL is not set, /bin/sh is
	    used.

SEE ALSO

     ldd(1), chdir(2), chroot(2), environ(7)

HISTORY

     The chroot utility first appeared in 4.4BSD.

SECURITY CONSIDERATIONS

     chroot should never be installed setuid root, as it would then be possible to exploit the program to gain root privileges.

BSD
								  August 13, 2011							       BSD