Apache chrooting simplified
I've added a new (and experimental) feature to mod_security (CVS and Apache 1.x only at the moment) that greatly simplifies the process of chrooting in most cases.
Essentially, the chroot call is made from Apache itself, at the very end of the initialisation process. The beauty of it is that Apache performs everything it needs (shared libraries, log files) before the chroot call and that allows you to put only data files into the jail.
I've written a short article here:
http://www.modsecurity.org/documentation/apache-internal-chroot.html
and the link in CVS is (again, only Apache 1.x):
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/*checkout*/mod-security/mod_security/apache1/mod_security.c?rev=1.4
What I have described works perfectly for me but I am interested to hear other opinions (or experiences). If you are interested please give it a try and let me know how you feel.
Hi, I'd like to try your chroot method. But one question: if my document root is set to /home/httpd/htdocs, then does it mean that I simply need to add the following line to apache.conf?
SecChrootDir /home/httpd
Kenneth
(|:-)
Posted by: Kenneth Wong | 30 July 2003 at 12:03 PM
Yes. However, from the point of view of the Apache all paths will change. So you will probably need to change "DocumentRoot /home/httpd/docs" to "DocumentRoot /docs".
Posted by: Ivan Ristic | 31 July 2003 at 08:16 PM
Hello. Just forgot to says that it works. And thanks for your mod_security and help!
Posted by: Kenneth Wong | 15 October 2003 at 05:37 AM