Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Sun, May 09, 2004 at 12:21:04AM -0700, Seth Alan Woolley wrote:
> Since there seems to be a long silence, I thought I'd break it with my
> latest project.  Since I lost my previous chroot environment in a
> harddrive crash, I thought I'd try to do it in an automated way this
> time.
> 
> I wrote a script that installs spells into a chroot environement from
> source cache:
> 
> http://seth.positivism.org/files/chrootize
> 
> http://seth.positivism.org/files/chrootize-example
> 
> It uses the dynamic linking checker ldd to recursively follow
> dependencies.
> 
> I got perl, bash, and GD working in a chroot with the above method.  A
> clean chroot that needed perl is in the example.
> 
> Just needed to first grab the files: passwd, shadow, group, and
> ld.so.conf from /etc and copy them over into the chroot; then run the
> mkbusybox script to get a basic cli from your already casted busybox;
> then weed out passwd, etc entries for every user you don't need; then
> run the chrootize script on what you need; then lastly chroot in and run
> ldconfig.
> 
> I then installed thttpd and set it to my chroot directory, gave it a cgi
> pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
> charm.
> 
> I just set my htdoc path to be the same as the root for the chroot, but
> if you want to hide your chroot files, you can put it anywhere within
> the chroot and use thttpd's -dd (datadir) argument.
> 
> Worry about the complexity of securing apache?  I find thttpd is so much
> simpler to lock down.  Then again, no module mess, either (though you
> may want to use the 'feature' of apache's modules).

Also forgot to link this:

http://seth.positivism.org/files/mkbusybox

and the main reason I installed busybox was to have a working ldconfig
... but if you have glibc installed, ldconfig is installed to /sbin.

So you don't even need busybox.

I might modify the chrootize script to automatically ldconfig the
environment and setup the /etc files, although since Hamish's iso work,
most of the /etc stuff is handled pretty well automatically.

Seth

P.S.  My source mirror should be back up soon -- it's refreshing as we
speak.

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgp72aWWpL4Us.pgp
Description: PGP signature