Re: chroot bind?

[Bryan Andersen <bryan@visi.com>]

Nicholas Lee wrote:
> 
> Please CC: not subscribe.
> 
> I'm interesting in doing some work to provide a bind-chroot package.
> (Its in fact pretty simply to copy the openbsd setup.)
> 
> The basic thing I'm not sure about is how something like this would fit
> into the debiab policy.
> 
> ie dev files like /var/named/dev/log and /var/named/dev/null.
> 
> Config files in /var/named/

Do it under /var/named, this follows other OSes conventions.  Another
reason is if someone does run an exploit against bind the partition they
are on won't be the root partition if the admin has separated out file
systems.  /etc is almost always on the root partition.  /var is often
separated out onto it's own partition.

A neet way I've seen chrot programs done is to leve the execuitables and
config files where they are normally, then  
-- 
|  Bryan Andersen   |   bryan@visi.com   |   http://www.nerdvest.com   |
| Buzzwords are like annoying little flies that deserve to be swatted. |
|   -Bryan Andersen                                                    |