FreeBSD Manual Pages
jk_uchroot(8) jk_uchroot jk_uchroot(8) NAME jk_uchroot - grant regular users the right to change root into certain di- rectories SYNOPSIS jk_uchroot -j <jail> -x <executable> DESCRIPTION jk_uchroot can be used to give regular users access to the chroot() system call in a safe way. jk_uchroot will only grant chroot into a jail if the configuration file lists this user and jail combination. jk_uchroot will furthermore only grant access if the chroot jail is safe. Safe means that it is owned by uid 0 gid 0 and not writable for others, including the sys- tem directories such as /bin, /lib, /dev/, /sbin, and /usr. jk_uchroot needs certain elevated privileges to make the chroot(2) system call. Therefore it is setuid root. It will drop its root privileges immedi- ately after making the chroot() system call. Since Jailkit 2.8 jk_uchroot may also use the CAP_SYS_CHROOT capability on systems that support capabil- ities, and then the setuid bit can be removed. [john] allowed_jails = /srv/johnjail, /srv/commonjail skip_injail_passwd_check = 1 [group users] allowed_jails = /srv/commonjail skip_injail_passwd_check = 1 In the above example jk_uchroot is configured not to check if the user ex- ists in the /etc/passwd file in the jails. FILES /etc/jailkit/jk_uchroot.ini DIAGNOSTICS jk_uchroot logs everything to syslog, please check the log files. Logging is sent to the LOG_AUTH facility with levels LOG_ERR and LOG_CRIT for crit- ical errors, LOG_NOTICE for non-critical errors, and LOG_INFO for normal events. On most systems the command grep jk_ /var/log/* will give you the information you need. SEE ALSO jailkit(8) jk_check(8) jk_chrootlaunch(8) jk_chrootsh(8) jk_cp(8) jk_init(8) jk_jailuser(8) jk_list(8) jk_lsh(8) jk_procmailwrapper(8) jk_socketd(8) jk_update(8) chroot(2) syslogd(8) COPYRIGHT Copyright (C) 2003, 2004, 2005, 2006, 2007, 2018 Olivier Sessink Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. JAILKIT 07-02-2010 jk_uchroot(8)
NAME | SYNOPSIS | DESCRIPTION | FILES | DIAGNOSTICS | SEE ALSO | COPYRIGHT
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=jk_uchroot&sektion=8&manpath=FreeBSD+Ports+15.1.quarterly>