grsecurity forums

Hello,

I have what I think is a simple question. I have setup a chroot jail for a service, and I want my startup script to chroot and then perform the setuid to the lower privilege user (or su and then chroot, either way).

What is the easiest way to do this? After looking through the docs, it seems that what I want to do is enable the ACL system, and then put an ACL on the setuid binary. Is there a better, more straightforward way to handle this?

Thanks,
Steve

have a look at daemontools: http://cr.yp.to/daemontools/setuidgid.html

here an example for running "program" as nobody in a chroot jail:
/usr/sbin/chroot /chroot/program /lib/setuidgid nobody program

bye,
lele