Re: RFC: dropping privs in chroot --user

2014-05-18 Thread Pádraig Brady
On 05/17/2014 12:48 PM, Pádraig Brady wrote: > On 05/17/2014 01:45 AM, Bernhard Voelker wrote: >> On 05/16/2014 10:59 PM, Pádraig Brady wrote: >> >> Thanks for the detailed tests. >> >>> [[ chroot --user=+5000 / id -G ]] >>> before: 0 1 2 3 4 6 10 >>> after: src/chroot: failed to get primary group

Re: RFC: avoid chroot() call if not changing root dir

2014-05-18 Thread Pádraig Brady
On 05/17/2014 10:40 AM, Pádraig Brady wrote: > On 05/17/2014 01:03 AM, Bernhard Voelker wrote: >> On 05/16/2014 11:02 PM, Pádraig Brady wrote: >>> Pushed. >> >> Sorry, a bit late ... >> >>> + /* Only do chroot specific actions if actually changing root. >>> + The main difference here is that w

Re: RFC: avoid chroot() call if not changing root dir

2014-05-18 Thread Bernhard Voelker
On 05/18/2014 06:27 PM, Pádraig Brady wrote: > From 70c4ffe8489334953c75b4a812c549ed5b72f03e Mon Sep 17 00:00:00 2001 > From: =?UTF-8?q?P=C3=A1draig=20Brady?= > Date: Sun, 18 May 2014 17:20:06 +0100 > Subject: [PATCH] chroot: make changing root check more robust > > * src/chroot.c (is_root): A ne

Re: RFC: dropping privs in chroot --user

2014-05-18 Thread Bernhard Voelker
On 05/18/2014 06:27 PM, Pádraig Brady wrote: > I also noticed another inconsistency where --user=500: was rejected > while --user=500 was not. They should both mean the same thing > with the new syntax anyway, so I've adjusted so that both area allowed. > > I split the change to avoid multiple dia

Re: RFC: dropping privs in chroot --user

2014-05-18 Thread Pádraig Brady
On 05/18/2014 07:12 PM, Bernhard Voelker wrote: > On 05/18/2014 06:27 PM, Pádraig Brady wrote: >> I also noticed another inconsistency where --user=500: was rejected >> while --user=500 was not. They should both mean the same thing >> with the new syntax anyway, so I've adjusted so that both area a