Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to lock a user into a given directory tree. That is he/she can cd deeper into the tree but no higher out of the tree. Everything else in the environment should be the exact same.

Edit: How can I do this without chroot. I am launching a bash via objective-c can creating a terminal-like application. I need to user to be able to access /usr/include and all the other places on they system, I just need them to be locked into a directory structure. chroot seems to require root privileges to run. Running bash in restrictive mode is to restrictive.

share|improve this question

migrated from stackoverflow.com Mar 4 '12 at 6:12

This question came from our site for professional and enthusiast programmers.

2  
Soooo, you want a chroot? –  Niklas B. Mar 4 '12 at 1:16
1  
Also, this should be on Unix & Linux. –  Niklas B. Mar 4 '12 at 1:17
1  
Not really programming related -- unless asking how this can be done programmatically, which does not seem to be the case. Voting to migrate. –  pst Mar 4 '12 at 1:17
add comment

3 Answers 3

Is chroot what you are looking for?

share|improve this answer
    
A chroot wouldnt work well for this as the etc, bin, lib, etc... directories will need to exist inside the chroot. You can set up bind mounts, but it would get extremely messy. –  Patrick Mar 4 '12 at 22:50
add comment

What are you trying to achieve?

If you want protection from the users, it's a security issue, and I can't imagine how reducing their ability to cd into any directory could be of any benefit. You could try a VM (pretty secure) or chroot jail (not very secure).

If you want to protect them from themselves, you can simply override cd in .bashrc like this:

cd() {
    builtin cd "$@"
    if [[ ! "$(pwd)" =~ ^$HOME ]]
    then
        echo "Escape is futile"
        builtin cd - >/dev/null
    fi
}
share|improve this answer
1  
"chroot jail not very secure"? –  Patrick Mar 5 '12 at 15:35
1  
Here you go. I especially like these quotes: "incompetent people implementing security solutions are a real problem" + "chroot is not and never has been a security tool." –  l0b0 Mar 5 '12 at 16:25
    
No, its not perfect, no one security implementation is. But I do argue that it provides quite a bit of security for minimal effort (compared to more drastic measures such as selinux or grsecurity). –  Patrick Mar 6 '12 at 0:38
add comment

Without help from the kernel you won't be able to fully restrict the user inside a directory. Even using strace/ktrace is limited because it will probably be complex to implement correctly and make the user experience a nightmare.

If you use FreeBSD, look at the jail sub system. It is really efficient. Else, you need to chroot your users, if they are logging via

share|improve this answer
    
Re: jails, on recent versions of Fedora, there's the "sandbox" program which can behave somewhat similarly to jails for this context. –  jsbillings Mar 4 '12 at 14:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.