Subject: problems with chrooting.

From: "[email-masked]"<[email-masked]>
Date: Tue, 6 Mar 2001 10:55:24 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello all, 

I am currently working with fwtk2.1, and i have some 
prolems to make plug-gw working correctly on my red-hat 
6.1 linux. 

First of all, in the manpages I saw the support of 
userid and groupid, but with a look at the source, i 
didn't manage to find it. So i added this few lines in 
plug-gw.c (shown in annex) and now it seems to work 
fine. ( childs runs under the unpriviledged userid).

I also decided to chroot this plug-gw and here i have 
still problems with name resolution (in syslog logs I 
only have IPs but not names, and rules cannot be set 
using names ( even if a line is added in 
$jail/etc/hosts). When i run chroot $jail /usr/bin/plug-
gw -daemon 7070

here is the config: 
# file plug-gw
plug-gw: ELF 32-bit LSB executable, Intel 80386,version 
1, statically linked, not stripped
(I compiled it statically so i think i should not have 
to copy libs ) 

the simple jail is: 

# ls -lR $jail
/home/quentin/jail:
total 12
drwxr-xr-x   2 root     users        4096 Mar  4 04:02 
dev
drwxr-xr-x   2 root     users        4096 Mar  6 10:38 
etc
drwxr-xr-x   4 root     users        4096 Mar  5 14:26 
usr

/home/quentin/jail/dev:
total 0
srw-rw-rw-   1 root     users           0 Mar  4 04:02 
log

/home/quentin/jail/etc:
total 20
-rw-r--r--   1 root     users          28 Mar  2 15:04 
group
-rwxr-xr-x   1 root     users          93 Mar  5 14:11 
hosts
-rw-r--r--   1 root     users        1727 Mar  2 15:01 
nsswitch.conf
-rw-r--r--   1 root     users         100 Mar  5 18:39 
passwd
-rw-r--r--   1 root     users           1 Mar  5 14:12 
resolv.conf

/home/quentin/jail/usr:
total 8
drwxr-xr-x   2 root     users        4096 Mar  5 18:28 
bin
drwxr-xr-x   3 root     users        4096 Mar  5 18:28 
local

/home/quentin/jail/usr/bin:
total 3008
-rwxr-xr-x   1 root     users     1594385 Mar  5 13:17 
plug-gw
-rwxr-xr-x   1 root     root      1470509 Mar  6 09:21 
udprelay

/home/quentin/jail/usr/local:
total 4
drwxr-xr-x   2 root     users        4096 Mar  5 18:29 
etc

/home/quentin/jail/usr/local/etc:
total 8
-rw-r--r--   1 root     users         229 Mar  5 18:10 
netperm-table
-rw-r--r--   1 root     root           44 Mar  5 18:29 
udp-netperm-table

Note: 
I also do the same thing with udprelay and encounter 
the same kind of problem with id in $jail/etc/passwd 
when compiled with NOBODY=nobody 
even if nobody is in my $jail/etc/paswd. 

I'd be very happy if someone could help me :) 

Thanks 
Quentin. 

ANNEX: 
55,56d54
<       int             rungid = -1;
<       int             runuid = -1;
119,144d116
< /*BEGIN:  ADD ON TO SUPPORT GROUPID AND USERID OPTION 
*/
<       if((cf = cfg_get("groupid",cfp)) != (Cfg *)0) {
<
<                 if(cf->argc != 1) {
<                         syslog(LLEV,"fwtkcfgerr: 
groupid must have one paramet
er,line %d",cf->ln);
<                         exit(1);
<                 }
<                 if((rungid = mapgid(cf->argv[0])) == -
1) {
<                         syslog(LLEV,"fwtkcfgerr: 
cannot map %.100s to gid",cf-
>argv[0]);
<                         exit(1);
<                 }
<         }
<
<       if((cf = cfg_get("userid",cfp)) != (Cfg *)0) {
<
<                 if(cf->argc != 1) {
<                         syslog(LLEV,"fwtkcfgerr: 
userid must have one paramete
r,line %d",cf->ln);
<                         exit(1);
<                 }
<                 if((runuid = mapuid(cf->argv[0])) == -
1) {
<                         syslog(LLEV,"fwtkcfgerr: 
cannot map %.100s to uid",cf-
>argv[0]);
<                         exit(1);
<                 }
<         }
< /* END:  ADD ON TO SUPPORT USERID AND GROUPID OPTION 
*/
<
159,168d130
< /*BEGIN:  ADD ON TO SUPPORT USERID AND GROUPID OPTION 
*/
<      if(rungid != -1 && setgid(rungid)) {
<              syslog(LLEV,"fwtksyserr: cannot setgid %
d: %m",rungid);
<              exit(1);
<      }
<      if(runuid != -1 && setuid(runuid)) {
<              syslog(LLEV,"fwtksyserr: cannot setuid %
d: %m",runuid);
<              exit(1);
<      }
<
170d131
< /*END:  ADD ON TO SUPPORT USERID AND GROUPID OPTION */

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Choisissez les offres que vous voulez recevoir
Et gagnez une playstation 2 ou des baladeurs MP3 
----> http://www.respublica.fr/site/yoptin <----
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---

From: Rick Murphy <[email-masked]>
Date: Tue, 06 Mar 2001 18:24:55 -0500

>(I compiled it statically so i think i should not have

Not necessarily true - some operating systems always use shared libraries 
for their resolver routines (Solaris). It wouldn't surprise me that you're 
missing a libresolv.so or some such in the chroot area.
         -Rick