How to emulate 'chroot /jail/ su httpd -c' ?

How to emulate 'chroot /jail/ su httpd -c' ?

[Tetsuo Handa]

Hello,

Sorry for querying userland program in this list.

I have the following line in /etc/rc.d/init.d/httpd

daemon chroot /jail/ su httpd -c $httpd $OPTIONS

This needs /bin/su after /usr/sbin/chroot, but I don't
want to place /bin/su (and related files) in the jail.
So, I want to do this with one program.

But, the problem is... there are so many 'set*id()'
system calls and their behavior are slightly differ.
I'm not sure how to emulate 'chroot /jail/ su httpd -c'.
The following is the code I wrote, but is this equivalent?
(I want Apache never re-gain root privilege unless
executing setuid-root program.)

--- Is this a correct code to 'chroot /jail/ su httpd -c' ?---

#include <stdio.h>
#include <pwd.h>
#include <sys/types.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
    struct passwd *pw = getpwnam("httpd");
    if (!pw) return 1;
    if (chroot("/jail/") || chdir("/") || setuid(pw->pw_uid) || setgid(pw->pw_gid)) return 1;
    printf("OK\n"); // Now call execvl() to run Apache.
    return 0;
}

---

Kernel version is 2.4.25.
No need to worry for listening port 80,
I'm using iptables to redirect port 80 to 8000
and Apache doesn't need root privilege from the beginning.


Regards...

                  PANDA   (a5497108 at anet.ne.jp)

Re: How to emulate 'chroot /jail/ su httpd -c' ?

[Tetsuo Handa]

Helge Hafting wrote:
> Tetsuo Handa wrote:
> > 
> > daemon chroot /jail/ su httpd -c $httpd $OPTIONS
> 
> Why don't you simply do the su first, and the chroot later?
> 
> Helge Hafting
> 

Thank you, Hafting.
But only root can chroot, so after su to httpd, can't chroot.

Re: How to emulate 'chroot /jail/ su httpd -c' ?

[Tetsuo Handa]

Patrick Michael Kane <modus@pr.es.to> wrote:
> Here's an easy way to do what you are trying to do:
> 
> http://worldserver3.oleane.com/bouynot/gabuzomeu/alex/doc/apache/index-en.html
> 
> Greetings from Hiro-o!
> 
> * Tetsuo Handa (a5497108@anet.ne.jp) [040226 03:01]:
> > Hello,
> > 
> > I have the following line in /etc/rc.d/init.d/httpd
> > 
> > daemon chroot /jail/ su httpd -c $httpd $OPTIONS
> > 

Thank you, Michael.
It's a nice article, but I'm using RedHat Linux 9.

It was very easy building chroot environment, for
I used a custom kernel that lists up files which are needed.
(I want to publish the patch, but I made it on business,
permission to publish is not given yet. I'm sorry.)

Only I can't do is 'chroot /jail/ su httpd -c' by one program.

Re: How to emulate 'chroot /jail/ su httpd -c' ?

[Måns Rullgård]

Tetsuo Handa <a5497108@anet.ne.jp> writes:

> Hello,
>
> Sorry for querying userland program in this list.
>
> I have the following line in /etc/rc.d/init.d/httpd
>
> daemon chroot /jail/ su httpd -c $httpd $OPTIONS
>
> This needs /bin/su after /usr/sbin/chroot, but I don't
> want to place /bin/su (and related files) in the jail.
> So, I want to do this with one program.

If you remove the suid bit from the su program in the chroot it should
be rather harmless.

-- 
Måns Rullgård
mru@kth.se

Re: How to emulate 'chroot /jail/ su httpd -c' ?

[Tetsuo Handa]

# Daily digest mail didn't arrive to me yesterday(2/25) and
# today(2/26), may be something is wrong with my mail server.
# Sorry for ignoring thread tree, this is a reply to
http://www.ussg.iu.edu/hypermail/linux/kernel/0402.3/0848.html

Ma*ns Rullga*rd wrote:
> Tetsuo Handa <a5497108@xxxxxxxxxx> writes:
> 
> > Hello,
> >
> > Sorry for querying userland program in this list.
> >
> > I have the following line in /etc/rc.d/init.d/httpd
> >
> > daemon chroot /jail/ su httpd -c $httpd $OPTIONS
> >
> > This needs /bin/su after /usr/sbin/chroot, but I don't
> > want to place /bin/su (and related files) in the jail.
> > So, I want to do this with one program.
> 
> If you remove the suid bit from the su program in the chroot it should
> be rather harmless.

Oh! What a nice idea! 
'chmod 500 /bin/su' is to the purpose.
Thank you.