Complete.Org: Mailing Lists: Archives: gopher: January 2002:
[gopher] Re: Security issues in Gopher?
Home

[gopher] Re: Security issues in Gopher?

[Top] [All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index] [Thread Index]
To: gopher@xxxxxxxxxxxx
Subject: [gopher] Re: Security issues in Gopher?
From: Robert Hahn <rhahn@xxxxxxxxxxxxxx>
Date: 22 Jan 2002 14:19:08 -0000
Reply-to: gopher@xxxxxxxxxxxx

ooo... that's *cool*.

ok, so, building on your example, what if I created a soft link to ls from 
within /home/anstouh?  would that be enough to work, or do I have to physically 
copy the binary to within that directory?

thx,
-rh


> Put simply, it puts you into gaol. If you typed, say, 
> $ chroot /home/anstouh
> all you could do is access the programs below /home/anstouh. You can't write 
> an
> event to a logfile, you can't run 'ls' (unless 'ls' happens to be somewhere in
> /home/anstouh, of course). 
> 
> If the only files in /var/gopher are owned by anstouh, read/writable by owner,
> readable by group and world, and you run a chrooted gopher as user nobody,
> there's not much someone can do if they manage to convince gopher to do
> anything other than serve up files and directories.
> 
> <Insert standard disclaimer.>
> 
> Tristan.



[Prev in Thread] Current Thread [Next in Thread]