Home / server / Questions / 49204
Accepted
lexsys
Asked: 2009-08-04 01:29:44 +0800 CST

What is the right way to chroot perl script?

  • 772

I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/.

Now I can run the script such a way:

# chroot /opt/chroot script.pl

There are two things that I am concerned about:

  1. Script gains root rights.
  2. There is a perl interpreter inside the chrooted environment.

How can I avoid these security holes?

security perl chroot

2 Answers

  1. Best Answer

    Chroot's on linux are not for security, if you have root, or mount abilites inside a chroot it's easy to break out.

    You should obviously drop root using su or similar, as long as the script doesn't have permissions to modify the interpreter files there shouldn't be a problem.

    To do this you need to add a larger hunk of code in a copy of su, and the core bits of PAM.

    Something like jailkit might be an easier way to manage this:

    http://olivier.sessink.nl/jailkit/index.html

    • 3

  2. Why don't you chroot inside of your perl script? In that way you don't need all the extra stuff inside of your chroot jail.

    Just add chroot() http://perldoc.perl.org/functions/chroot.html at someplace in your script, followed by chdir("/").

    After that, drop your privileges and you are set.

    • 2