Conversation started Oct 6, 2011 at 20:27.
Marco Ceppi
Marco Ceppi
Oct 6, 2011 20:27
Is there an easier way to setup a chroot? I want to avoid "installing ubuntu into a chroot"
help.ubuntu.com/community/BasicChroot
I seem to remember it being: setup chroot, symlink binaries & directories etc, ???, profit
 
1 hour later…
Marco Ceppi
Marco Ceppi
Oct 6, 2011 21:34
Arg this is frustrating.
jrg
jrg
What is your end goal?
Marco Ceppi
Marco Ceppi
Chroot all users while maintaining their files outside of the chroot
So regular systems like apache and courier can access them
jrg
jrg
arkose on login with the following: sudo arkose -n -h -c "cd $PWD; $SHELL"
Marco Ceppi
Marco Ceppi
this is the fourth time I've heard of arkose
jrg
jrg
copy-on-write sandbox.
@MarcoCeppi Probably all from me. :P
Marco Ceppi
Marco Ceppi
Oct 6, 2011 21:38
So, that'll sandbox the user in a jailed folder?
Because I'm not trying to sandbox apache - but the user when they log in via SSH
jrg
jrg
so you're trying to prevent us from installing random stuff, right?
Marco Ceppi
Marco Ceppi
More or less. I'm more worried about you all jumping into each others folders
and copying data
I can't chmod 0750 home folders because then Apache can't get in
jrg
jrg
that'll do it. the $PWD part will restrict us to our own user.
Marco Ceppi
Marco Ceppi
hum, I will try this out
because setting up these chroots is driving me nuts
jrg
jrg
so, if I have /home/foobar, /home/jrg, and i'm logged in as jrg, the only dir i have access to (inside arkose) is /home/jrg.
Marco Ceppi
Marco Ceppi
Oct 6, 2011 21:41
if this works, it'll save me quite a few days of playing with choots - which means more development time \o/
jrg
jrg
user image
Marco Ceppi
Marco Ceppi
Right, so I just need to setup sudoers so everyone can execute arkose, then have it run when they connect?
jrg
jrg
yup.
Marco Ceppi
Marco Ceppi
Secondly - how does a user, or can a user, break out of arkose?
Is it just a jailed shell?
All these answers and more can be found on the interntes!
jrg
jrg
yup. so exit will get us out
 
Conversation ended Oct 6, 2011 at 21:44.