2

I want to lock a user into a given directory tree. That is he/she can cd deeper into the tree but no higher out of the tree. Everything else in the environment should be the exact same.

Edit: How can I do this without chroot. I am launching a bash via objective-c can creating a terminal-like application. I need to user to be able to access /usr/include and all the other places on they system, I just need them to be locked into a directory structure. chroot seems to require root privileges to run. Running bash in restrictive mode is to restrictive.

Improve this question
3
  • 2
    Soooo, you want a chroot?
    – Niklas B.
    Mar 4, 2012 at 1:16
  • 1
    Also, this should be on Unix & Linux.
    – Niklas B.
    Mar 4, 2012 at 1:17
  • 1
    Not really programming related -- unless asking how this can be done programmatically, which does not seem to be the case. Voting to migrate.
    – pst
    Mar 4, 2012 at 1:17

3 Answers 3

Reset to default
2

Is chroot what you are looking for?

Improve this answer
1
  • A chroot wouldnt work well for this as the etc, bin, lib, etc... directories will need to exist inside the chroot. You can set up bind mounts, but it would get extremely messy.
    – phemmer
    Mar 4, 2012 at 22:50
1

What are you trying to achieve?

If you want protection from the users, it's a security issue, and I can't imagine how reducing their ability to cd into any directory could be of any benefit. You could try a VM (pretty secure) or chroot jail (not very secure).

If you want to protect them from themselves, you can simply override cd in .bashrc like this:

cd() {
    builtin cd "$@"
    if [[ ! "$(pwd)" =~ ^$HOME ]]
    then
        echo "Escape is futile"
        builtin cd - >/dev/null
    fi
}
Improve this answer
3
  • 1
    "chroot jail not very secure"?
    – phemmer
    Mar 5, 2012 at 15:35
  • 1
    Here you go. I especially like these quotes: "incompetent people implementing security solutions are a real problem" + "chroot is not and never has been a security tool."
    – l0b0
    Mar 5, 2012 at 16:25
  • No, its not perfect, no one security implementation is. But I do argue that it provides quite a bit of security for minimal effort (compared to more drastic measures such as selinux or grsecurity).
    – phemmer
    Mar 6, 2012 at 0:38
0

Without help from the kernel you won't be able to fully restrict the user inside a directory. Even using strace/ktrace is limited because it will probably be complex to implement correctly and make the user experience a nightmare.

If you use FreeBSD, look at the jail sub system. It is really efficient. Else, you need to chroot your users, if they are logging via

Improve this answer
1
  • Re: jails, on recent versions of Fedora, there's the "sandbox" program which can behave somewhat similarly to jails for this context.
    – jsbillings
    Mar 4, 2012 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .