[gopher] Re: Security issues in Gopher?

[Robert Hahn <rhahn@tenletters.com>]

ooo... that's *cool*.

ok, so, building on your example, what if I created a soft link to ls from within /home/anstouh?  would that be enough to work, or do I have to physically copy the binary to within that directory?

thx,
-rh


> Put simply, it puts you into gaol. If you typed, say, 
> $ chroot /home/anstouh
> all you could do is access the programs below /home/anstouh. You can't write an
> event to a logfile, you can't run 'ls' (unless 'ls' happens to be somewhere in
> /home/anstouh, of course). 
> 
> If the only files in /var/gopher are owned by anstouh, read/writable by owner,
> readable by group and world, and you run a chrooted gopher as user nobody,
> there's not much someone can do if they manage to convince gopher to do
> anything other than serve up files and directories.
> 
> <Insert standard disclaimer.>
> 
> Tristan.