There has been posted a topic before about how would you chroot a user so that he cant breakout of his ENV.
Unfortunatly this week end I had to site back home and keep trying to build chroot ENV with the ACL system.
After a great Effort I was able to do such a thing, now IT aint perfect and few people as a matter of fact might say it's not a chroot env but i will show you the DEMO.
Steps to create a chroot Env for local users ( wethter they log via keyboard/telnet/SSH)
1) Choose your favorite shell (ksh,bash,etc..)
2) make a copy of that shell in same dir but in a new name ( for example I cp /bin/bash /bin/bash3 )
3) add bash3 to /etc/shells
4) add any user on your system and let his shell be /bin/bash3
5) Modify your ACL system with this new bash and In a LEARN MODE! its important that you add it in a learning mode
Ex ( copied of my system ) :
/bin/bash3 lo {
/h
-CAP_ALL
RES_FSIZE 0 0
RES_DATA 0 0
RES_RSS 0 0
RES_NOFILE 0 0
RES_MEMLOCK 0 0
RES_STACK 0 0
RES_AS 0 0
RES_NPROC 0 0
RES_LOCKS 0 0
connect {
disabled
}
bind {
disabled
}
}
6) Login as that user for awhile while gradm is in learning mode to inherite the state of that bash.
7) when you think its the right time , have a look at the generated ACL
that was the generated ACL on my system: ( the username assumed is ForEver)
**************************************************************************************************************************
/bin/bash3 o {
/usr/share/locale/locale.alias r
/usr/lib/locale/en_US/LC_CTYPE rx
/usr/bin x
/usr/X11R6/bin
/sbin/shutdown x
/sbin/ifconfig r
/sbin/consoletype x
/sbin r
/proc/meminfo r
/proc
/misc
/lib rx
/lib/ld-2.2.5.so x
/lib/i686/libc-2.2.5.so rx
/home/ForEver/.bashrc rx
/home/ForEver/.bash_profile r
/home/ForEver/.bash_logout r
/home/ForEver/.bash_history ra
/home/ForEver r
/etc/sysconfig/i18n r
/etc/profile.d rx
/etc/ld.so.cache rx
/etc r
/dev/tty rw
/dev/null w
/dev
/boot
/bin x
/bin/bash3 x
/
-CAP_ALL
RES_FSIZE 54532 54532
RES_DATA 238320 238320
RES_STACK 25576 25576
RES_RSS 0 0
RES_NPROC 6 5
RES_NOFILE 260 260
RES_MEMLOCK 0 0
RES_AS 2982176 2982176
RES_LOCKS 0 0
connect {
disabled
}
bind {
disabled
}
}
**************************************************************************************************************************
as you can see clearly that is the requirmets of the SHELL , now the user is not in a chrooted Environment but we know what FILES EXACTLY he needs so the idea of jailing is to give the USER the least Requirments needed by the system to give him a small room where he can sit. in the above ACL many things were given that should be taken off.
That's why i modified the ACL to look like :
/bin/bash3 o {
/usr/share/locale/locale.alias r
/usr/lib/locale/en_US/LC_CTYPE rx
/usr/bin x
/usr/X11R6/bin
/sbin h
/sbin/shutdown x
/sbin/ifconfig r
/sbin/consoletype x
/proc/meminfo r
/proc
/misc
/lib rx
/lib/ld-2.2.5.so x
/lib/i686/libc-2.2.5.so rx
/home h
/home/ForEver/.bashrc rx
/home/ForEver/.bash_profile r
/home/ForEver/.bash_logout r
/home/ForEver/.bash_history ra
/home/ForEver r
/etc h
/etc/sysconfig/i18n r
/etc/profile.d rx
/etc/ld.so.cache rx
/dev h
/dev/tty rw
/dev/null w
/boot h
/bin x
/bin/bash3 x
/ h
-CAP_ALL
RES_FSIZE 54532 54532
RES_DATA 238320 238320
RES_STACK 25576 25576
RES_RSS 0 0
RES_NPROC 6 5
RES_NOFILE 260 260
RES_MEMLOCK 0 0
RES_AS 2982176 2982176
RES_LOCKS 0 0
connect {
disabled
}
bind {
disabled
}
}
**************************************************************************************************************************
as you can see clearly / is now hidden and /home is hidden /sbin is hidden as well why would i need my user to execute Administrative tasks ? right? I will give him only what he needs from sbin and acl already told mewhat he needs.
**************************************************************************************************************************
Demonstration of User ForEver Logging in
bash3-2.05a$ ls
nadine psybnc
bash3-2.05a$
bash3-2.05a$ cd /
bash3: cd: /: No such file or directory
bash3-2.05a$ cd /home
bash3: cd: /home: No such file or directory
bash3-2.05a$ cd /etc
bash3: cd: /etc: No such file or directory
bash3-2.05a$ cd /boot
bash3: cd: /boot: No such file or directory
AS you can see the user can go no where Besides his Home Directory ( few other dir's that you can assighn em as h if you want )
I hope this could lecture some one in chrooting maybe its not a chroot method but idont think the user has away to run outside his Home Directory.
I'll appreciate any comments given out to me here.
