On Sat, 5 Oct 2002, Rob Park wrote:
> Not necessarily. For example, if you had a process that needs /bin and /dev,
> but you needed to keep it out of /usr, you could chroot it somewhere, then
> bind bin and dev to there, and it'll do what you want. It'll have access to
> what it needs, but nothing it doesn't.
This approach is _sooo_ ghetto. So what if it needs access to some files
in /bin and /dev? That's _no_ excuse for mounting those. Just _copy_ the
parts of /bin and /dev that it needs to the chroot environment and you're
done. You can't possibly need the entire contents of those directories.
For example, chrooting BIND isn't exactly a straightforward task, but it's
still just a matter of copying the libc shared library, the linker
library, and less than a half-dozen other things into the chroot (even for
Solaris).
--
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.