Ti, Anders, On Saturday 18 September 2004 02:37, Ti Kan wrote:

Anders Norrbring writes:

...

Can I chroot a user to his/her home directory? Or something similar..

I want to block users from snooping around the files on the computer, but they should still have access via path to the standard set of applications that they normally has.

Unfortunately, no. Once you 'chroot' a process, the "root directory" (top of the whole filesystem hierarchy) as seen by that process becomes where you chroot'ed it to. Unless you make copies of /bin, /usr/bin, /lib, /usr/lib, /dev, etc., into the user's home directory all those directories will be invisible to the user and the user will not be able to do anything.

What you say is true, but that does not mean it's impossible to accomplish what Anders is attempting. It does mean that you have to replicate as much of an execution environment as you want the user to be able to access. That means executables, libraries, configuration files, etc., all as necessary to permit proper function of whatever software you _do_ want users to be able to successfully use. Unfortunately, you cannot use symbolic links,though hard links will work, assuming the other limitations of hard links are met, namely that they don't cross file system boundaries. Unless you want to set up an extremely restrictive environment, it can be pretty difficult to pull this off and it can easily require replicating enormous amounts of the system. Figuring out what's required and verifying that you've got everything that's needed can be pretty challenging. Creating statically linked executables can help out a little, by minimizing shared library dependencies.

...

-Ti

Randall Schulz