To: gopher@complete.org
Subject: [gopher] Re: Security issues in Gopher?
References: <20020122140520.88103.qmail@ingwaz.pair.com>
From: John Goerzen <jgoerzen@complete.org>
Date: 22 Jan 2002 10:00:07 -0500
In-Reply-To: <20020122140520.88103.qmail@ingwaz.pair.com>
Message-ID: <878zaqe8i0.fsf@complete.org>
Lines: 17
User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.4 (Common Lisp)
MIME-Version: 1.0
Content-type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
Sender: gopher-bounce@complete.org
Errors-to: gopher-bounce@complete.org
Precedence: bulk
Reply-to: gopher@complete.org


Robert Hahn <rhahn@tenletters.com> writes:

> Interesting.  I manned chroot last night, which gave me a clear answer as to what and how, but, as is typical with all man pages, lacks a 'why'. :P
> 
> So, can you explain what the significance of chroot* is and how it
> increases security?  Especially as it compares to running a server
> either as 'nobody' or (horrors) root?

It means that the files not under that directly are completely and
forever inaccessible* to that process and all of its children.  Even a
process running as nobody can read /etc/passwd.

So, run gopherd as nobody and put it chrooted, and you've got a
bombproof protection.

* Exceptions exist for the superuser.