Re: [gentoo-user] apache/php: chroot?

[Hans-Werner Hilse]

Hi,

On Tue, 25 Jul 2006 19:33:29 +0200
Jarry <jarry@×××.net> wrote:

> Hans-Werner Hilse wrote:
>
> > This won't work. Apache doesn't have inbuilt chroot facilities, AFAIK.
> > Like most of the other standard internet services. You would have to
> > setup a chroot env (all dependant libraries and stuff) for that. But
> > there's nothing similar to a chroot automatic in apache. BTW, such a
> > thing would probably break all CGIs.
>
> I got this idea reading "Securing & Optimizing Linux 3.0", where
> apache and php is running in chroot (+ a few more services like
> ssh, snort, ntp, bind, dhcp, ldap, mod_perl).
>
> Unfortunatelly, the book is a little out-of-date, and it is not
> easy to apply it to gentoo. But I think running apache+php+mod_perl
> in chroot would be definitelly nice feature...

Yes, certainly. There is a difference, though, between programs that
have chroot-functionality built-in and those you need to setup a chroot
jail for. I thought you were asking for the former. In fact, you can
setup any application to run chroot'ed. But in order to do this, you
need to setup a "jail". That would include needed libraries and
configuration and data. Then you can use that as a chroot jail for the
application by running it via the chroot executable (man 1 chroot).

OTOH, there are programs that chroot themselves. They call chroot()
(man 2 chroot) after reading configuration and such restrict their own
filesystem namespace to just the needed excerpt with the data files. So
if an attacker injects code, it cannot access most parts of the
filesystem.

For Apache there's always the first option, to setup a jail. There's
app-misc/jail to support that task. When finished, you would have to
edit apache's init.d script in order to call
"chroot /jail/usr/bin/httpd2-prefork" instead of
"/usr/bin/httpd2-prefork" (just an example, I didn't check the init.d
file).

-hwh
-- 
gentoo-user@g.o mailing list