Re: [uml-devel] Re: pcap cross-linking [PATCH]

[Blaisorblade <blaisorblade@yahoo.it>]

[-- Attachment #1: Type: text/plain, Size: 1167 bytes --]

On Tuesday 20 December 2005 21:01, Rob Landley wrote:
> On Monday 19 December 2005 12:33, Antoine Martin wrote:
> > I think I'll rebuild it with compartment and build su without pam to
> > trim it down even more.

> > > > (also lib/security so I can get into the chroot)

> > > That's for su, right? There are some tools (including "compartment") to
> > > combine chroot + su together.

> > Yep, it's a shame compartment does not ship with all distros.
> > chroot without su is pointless (since you can use 'chroot-again' to
> > escape) changing uid/guid should really be included in chroot.

> This is the first I've heard of it, and after few minutes of googling the
> best I can find on it is this:
>   http://www.suse.de/~marc/SuSE.html

> Which is from February 2001.
> Is that the newest version?

Don't know, guess yes - and that's more or less the URL I had. I know it just 
because it was mentioned here (by Gerd Knorr, maybe - former SuSE UML 
maintainer).
-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade

[-- Attachment #2: chroot-setuid.c --]
[-- Type: text/x-csrc, Size: 669 bytes --]

#include <stdio.h>
#include <errno.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
	int uid;
	char *dir, **command, *end;
	
	if(argc < 3){
		fprintf(stderr, "Usage - do-chroot dir uid "
                  "command-line...\n");
		exit(1);
	}

	dir = argv[1];
	uid = strtoul(argv[2], &end, 10);
	if(*end != '\0'){
		fprintf(stderr, "the uid \"%s\" isn't a number\n", \
                  argv[2]);
		exit(1);
	}
	command = &argv[3];

	if(chdir(dir) < 0){
		perror("chroot");
		exit(1);
	}

	if(chroot(".") < 0){
		perror("chroot");
		exit(1);
	}

	if(setuid(uid) < 0){
		perror("setuid");
		exit(1);
	}

	execv(command[0], command);
	perror("execv");
	exit(1);
}