Public SourceMage Discussion List

[Vladimír Marek <vlmarek AT volny.cz>]

> > Since there seems to be a long silence, I thought I'd break it with my
> > latest project.  Since I lost my previous chroot environment in a
> > harddrive crash, I thought I'd try to do it in an automated way this
> > time.

Great news, possibility to run certain serveces in chroot would be
really great.

> > I wrote a script that installs spells into a chroot environement from
> > source cache:
> > 
> > http://seth.positivism.org/files/chrootize
> > 
> > http://seth.positivism.org/files/chrootize-example
> > 
> > It uses the dynamic linking checker ldd to recursively follow
> > dependencies.

As I went only quickly through your source, it basically means that you
unpack allready compiled spell from cache to arbitrary directory and
follow all dll dependencies ?

> > I got perl, bash, and GD working in a chroot with the above method.  A
> > clean chroot that needed perl is in the example.
> > 
> > Just needed to first grab the files: passwd, shadow, group, and
> > ld.so.conf from /etc and copy them over into the chroot; then run the
> > mkbusybox script to get a basic cli from your already casted busybox;
> > then weed out passwd, etc entries for every user you don't need; then
> > run the chrootize script on what you need; then lastly chroot in and run
> > ldconfig.
+ delete all unnecessary ld.so.conf entries I would say

> > I then installed thttpd and set it to my chroot directory, gave it a cgi
> > pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
> > charm.
> > 
> > I just set my htdoc path to be the same as the root for the chroot, but
> > if you want to hide your chroot files, you can put it anywhere within
> > the chroot and use thttpd's -dd (datadir) argument.
> > 
> > Worry about the complexity of securing apache?  I find thttpd is so much
> > simpler to lock down.  Then again, no module mess, either (though you
> > may want to use the 'feature' of apache's modules).

Since I am prividing subversion repository through ssh, I would like to
chroot ssh and subversion. Do you think it's worth ?

> and the main reason I installed busybox was to have a working ldconfig
> ... but if you have glibc installed, ldconfig is installed to /sbin.
> 
> So you don't even need busybox.

Are you sure you will be able to enter the chrooted environment without
busybox ? I don't want to copy my whole system to chroot :) Well, best
is to try myself :)

> I might modify the chrootize script to automatically ldconfig the
> environment and setup the /etc files, although since Hamish's iso work,
> most of the /etc stuff is handled pretty well automatically.
> 
> Seth
> 
--
        Neuron

Attachment: pgpAPnqtzDA6v.pgp
Description: PGP signature