ModSecurity Breach

ModSecurity Blog

« URL decoding bug fixed | Main | Fun with PHP CLI scripts »

Apache chrooting simplified

I've added a new (and experimental) feature to mod_security (CVS and Apache 1.x only at the moment) that greatly simplifies the process of chrooting in most cases.

Essentially, the chroot call is made from Apache itself, at the very end of the initialisation process. The beauty of it is that Apache performs everything it needs (shared libraries, log files) before the chroot call and that allows you to put only data files into the jail.

I've written a short article here:
http://www.modsecurity.org/documentation/apache-internal-chroot.html

and the link in CVS is (again, only Apache 1.x):
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/*checkout*/mod-security/mod_security/apache1/mod_security.c?rev=1.4

What I have described works perfectly for me but I am interested to hear other opinions (or experiences). If you are interested please give it a try and let me know how you feel.

Hi, I'd like to try your chroot method. But one question: if my document root is set to /home/httpd/htdocs, then does it mean that I simply need to add the following line to apache.conf?

SecChrootDir /home/httpd

Kenneth
(|:-)

Yes. However, from the point of view of the Apache all paths will change. So you will probably need to change "DocumentRoot /home/httpd/docs" to "DocumentRoot /docs".

Hello. Just forgot to says that it works. And thanks for your mod_security and help!

The comments to this entry are closed.

Calendar

November 2010
Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6
7 8 9 10 11 12 13
14 15 16 17 18 19 20
21 22 23 24 25 26 27
28 29 30

Feeds

Atom Feed

Search

Categories

Recent Entries

Archives