Re: securety related question...
Rob Park <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Message-ID | <[email protected]> |
On Saturday 05 October 2002 05:05 pm, [email protected] wrote: > On Sat, 5 Oct 2002, Bob Kimmel wrote: > > I asked a question on one of the LFS groups a while back, and someone > > told me about the --bind option of mount, which causes the same files > > to appear in more than one place in the directory structure. It seems > > to me this feature could be used to create virtual chroot jails - even > > if the files needed by a particular app/daemon are dispersed, shared > > with other daemons, etc., one could create a jail directory, and then > > mount --bind the needed directories within the jail. > > > > Is this analysis correct? Are there performance issues with this > > approach? Has anyone done this, thought about doing it, tried it > > and found it doesn't work, etc.? I'd be interested in hearing > > opinions... > > The point of chrooting something is to _deny utterly_ any chance it has of > accessing other parts of the filesystem. If you mount other parts of the > filesystem that are in use elsewhere, you _defeat the purpose_ of > chrooting. Not necessarily. For example, if you had a process that needs /bin and /dev, but you needed to keep it out of /usr, you could chroot it somewhere, then bind bin and dev to there, and it'll do what you want. It'll have access to what it needs, but nothing it doesn't. -- Rob Park http://www.ualberta.ca/~rbpark -- In a gathering of two or more people, when a lighted cigarette is placed in an ashtray, the smoke will waft into the face of the non-smoker. -- Unsubscribe: send email to [email protected] and put 'unsubscribe lfs-security' in the subject header of the message