[gopher] Re: Security issues in Gopher?
[Top] [All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index] [Thread Index]
ooo... that's *cool*.
ok, so, building on your example, what if I created a soft link to ls from
within /home/anstouh? would that be enough to work, or do I have to physically
copy the binary to within that directory?
thx,
-rh
> Put simply, it puts you into gaol. If you typed, say,
> $ chroot /home/anstouh
> all you could do is access the programs below /home/anstouh. You can't write
> an
> event to a logfile, you can't run 'ls' (unless 'ls' happens to be somewhere in
> /home/anstouh, of course).
>
> If the only files in /var/gopher are owned by anstouh, read/writable by owner,
> readable by group and world, and you run a chrooted gopher as user nobody,
> there's not much someone can do if they manage to convince gopher to do
> anything other than serve up files and directories.
>
> <Insert standard disclaimer.>
>
> Tristan.
|
|