Problem - Kevin Tafuro

access to the filesystem, the potential for damage (whether it is reading sensitive data
or destroying data) is localized to the restricted directory hierarchy imposed by altering
the process’s root directory.
Unfortunately, one often overlooked caveat applies to using chroot( ). The first time
that chroot( ) is called, it does not necessarily alter the process’s current directory,
which means that until the current directory is forcibly changed, it may still be possible
to access areas of the filesystem outside the new root directory structure. It is
therefore imperative that the process calling chroot( ) immediately change its current
directory to a directory within the new root directory structure. This is easily
accomplished as follows:
#include
chroot("/new/root/directory");
chdir("/");
One final point regarding the use of chroot( ) is that the system call requires the calling
process to have superuser privileges.
2.13 Restricting Filesystem and Network Access
on FreeBSD
Problem
Your program runs primarily (if not exclusively) on FreeBSD, and you want to
impose restrictions on your program’s filesystem and network capabilities that are
above and beyond what chroot( ) can do. (See Recipe 2.12.)
Solution
FreeBSD implements a system call known as jail( ), which will “imprison” a process
and its descendants. It does all that chroot( ) does and more.
Discussion
Ordinarily, a jail is constructed on FreeBSD by the system administrator using the
jail program, which is essentially a wrapper around the jail( ) system call. (Discounting
comments and blank lines, the code is a mere 35 lines.) However, it is possible
to use the jail( ) system call in your own programs.
The FreeBSD jail does everything that chroot( ) does, and then some. It restricts
much of the superuser’s normal abilities, and it restricts the IP address that programs
running inside the jail may use.
Restricting Filesystem and Network Access on FreeBSD | 69
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.