1 |
On Fri, 2003-07-18 at 02:49, Matt Rickard wrote: |
2 |
> On 18 Jul 2003 01:15:00 -0400 |
3 |
> Brandon Hale <brandon@××××××××××.com> wrote: |
4 |
> > I propose a new USE flag for a few key services that would install the |
5 |
> > package in a chroot "out of the box." This idea was inspired by a |
6 |
> > conversation between Greg Fitzgerald (gregf) and myself on applying |
7 |
> > ideas from OpenBSD to Gentoo. Another source of inspiration is the |
8 |
> > excelent pkg_config code in the latest bind9 ebuilds. I further |
9 |
> > discussed this idea w/ memebers of the gentoo-hardened team and |
10 |
> > further crystalized the workings of such a flag. I would propose that |
11 |
> > the ebuild include two conditional install proceedures keyed on the |
12 |
> > chroot USE flag. The only possible problem I forsee is building |
13 |
> > devices inside the sandbox, which could be accomplished in |
14 |
> > pkg_postinstall as a last resort. I would be happy for any feedback or |
15 |
> > further development of this idea. |
16 |
> |
17 |
> I think this is a good idea. A chroot USE flag would allow daemons to |
18 |
> be chrooted transparently without users having to manually ebuild |
19 |
> config. Chroot building could be done in the sandbox, and as Brandon |
20 |
> mentioned, we could create the device files with pkg_postinst. These |
21 |
> could be removed with pkg_postrm explicitly. |
22 |
> |
23 |
> Eventually I would like to see this USE flag apply to more daemons than |
24 |
> just bind. I don't know which other packages in portage currently have |
25 |
> chrooting options (anyone help me out here?), but I'd at least like to |
26 |
> see this for ntpd and apache to start. |
27 |
|
28 |
PowerDNS is another, apache can run chrooted (but you loose a few |
29 |
features, but on a production server those shouldnt be very important). |
30 |
I bet there are many we-run-as-root servers out there that fairly easy |
31 |
can be chrooted (actually in theory you can chroot almost all services). |
32 |
|
33 |
I propose yes to this aswell. |
34 |
|
35 |
-- |
36 |
Christan Axelsson |
37 |
smiler@××××××××××.nu |
38 |
|
39 |
GPG key ID |
40 |
6C3C55D9 @ ldap://keyserver.pgp.com |