RE: securety related question...

On Sat, 5 Oct 2002, Bob Kimmel wrote:

> I asked a question on one of the LFS groups a while back, and someone
> told me about the --bind option of mount, which causes the same files
> to appear in more than one place in the directory structure.  It seems
> to me this feature could be used to create virtual chroot jails - even
> if the files needed by a particular app/daemon are dispersed, shared
> with other daemons, etc., one could create a jail directory, and then
> mount --bind the needed directories within the jail.
>
> Is this analysis correct?  Are there performance issues with this
> approach?  Has anyone done this, thought about doing it, tried it
> and found it doesn't work, etc.?  I'd be interested in hearing
> opinions...

The point of chrooting something is to _deny utterly_ any chance it has of
accessing other parts of the filesystem.  If you mount other parts of the
filesystem that are in use elsewhere, you _defeat the purpose_ of
chrooting.



-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe blfs-support' in the subject header of the message