New answers tagged chroot
Who the heck is blocking me from chrooting? It wasn't SELinux - that was a wild goose chase (getenforce returning "Permissive" means that SELinux is indeed no longer in the picture). The culprit - after adding quite a number of printk in the kernel's source to trace the failures of both chroot and mount - turned out to be capabilities. More specifically, ...
I already wrote a tutorial on creating a 32-bit chroot, so I'm not going to repeat it here, and I'm going to assume that you've read it. In this answer I'll just address the specific points in your question. They always include a command that downloads system from some URL they have chosen, like below. I want to use similar system I already have, and as ...
You might try rebuilding the coreutils package with ./configure --enable-single-binary so it shares a binary between all utilities like busybox does
Build one in a VM, first, then copy it to a subdirectory to be your chroot one. And, yes, I have done this and used it to do 32-bit clean builds.
Essential packages are necessary on a normal system, but a chroot isn't really a normal system. You don't need the packages that provide system services that Android is effectively providing (if in a way that won't let you do all you can do on a normal Linux system), such as init and login. You can tell dpkg to remove packages marked essential with the ...
If the build was successful, once it is completed, there will be a foo.pkg.tar.xz in the build directory and you can use pacman to install the built package: sudo pacman -U foo.pkg.tar.xz
The important part of the output of sudo -l is the last line(s): User <user> may run the following commands on this host: (ALL) ALL If what you mean by "allow the user to chroot" is "run the command chroot", then you already have that permission.
set -e means that the shell should exit immediately if any command exits with a non-zero status (except in some contexts that explicitly test exit status, such as the condition of an if or while). If you want the option to be in effect only while main() is running, you can do: set -e main "$@" set +e
Linux-from-scratch is great but it takes a lot of time like you say. You can lock any account by the command passwd -l <user>. If you do this with root then be sure that you have a working sudo configuration. chroot is used to run applications in a sandbox. If it is hacked then the hacker cannot change the rest of your system. Managing a system ...
Please take a look at the following answer http://stackoverflow.com/questions/394984/best-practice-to-run-linux-service-as-a-different-user it does not fully answer your question - i.e it does not provide an answer using pure-ftpd switches but gives several generic methods as well as gotchas that may be worth thinking about
A chroot jail only prevents processes that are running in the chroot from directly accessing files outside the chroot. It doesn't prevent processes in the chroot from accessing things other than files, such as other processes (which can be killed and ptraced if running as the same user), the network, etc. It also doesn't prevent processes in the chroot from ...
Some daemons (e.g.: postfix, apache) have the option to lower their operating UID after they start. It doesn't appear that pure-ftpd has that option. So you need to have your distro do it. FreeBSD, for example, allows you to set the UID of each daemon in the various rc scripts. You could also start it out of inetd. Using inetd will cause it to take longer ...
Yes, it might be worth enforcing SELinux policies even in a container. One idea behind SELinux is to have a second line of defense, i.e. if some container (or chroot) breaks, a process within it might still not do what it wants - or, it may not even be able to break the container due to SELinux - or, it cannot even do something undesirable within the ...
Top 50 recent answers are included