Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd
  • Date: Fri, 14 May 2004 08:58:54 -0700

Quoting Seth Alan Woolley <seth AT positivism.org>:
> Not really. That's to provide a different BUILD file for spells that
> want to chroot themselves as part of the cast process.
>
> I've just been having the spells chroot whenever possible. Non-chrooted
> spell versions are not advisable if they can be chrooted.
>
> I haven't run into any issues with spells that have been chrooted such
> as bind and ntp to warrant a non-chroot option. Should we give the user
> the choice? For thttpd, they have the choice for example in
> /etc/sysconfig/thttpd. That could easily be done for ntp and bind as
> well, although I don't see the point on those two. thttpd would
> legitimately need a choice since people may want to enable access to
> system programs for cgi execution.
>
> Looking at the bug, I can see the intent, but I'd rather not to have to
> require a recast to change from chroot to non-chroot, hence the
> /etc/sysconfig/thttpd flag to set chroot or not which just requires a
> telinit run thttpd restart.
>
> Seth

A choice of course. ;) We don't want to tell the person how they want to run
their services on their own box.

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.




Archive powered by MHonArc 2.6.24.

Top of Page