On 8/17/19 4:35 AM, Ulrich Mueller wrote: >>>>>> On Sat, 17 Aug 2019, Michael Orlitzky wrote > > Same for the "sshd" user, which IIRC chroots to /var/empty, but must > not (be able to) write to that dir. >
OpenSSH is configurable in this regard, but this was a prescient example. OpenNTPd has a similar ./configure option for its chroot directory -- and then ignores it and chroots to $HOME anyway. In cases like that, probably the best we can do is to use a "unique" user and home directory, insofar as we can do that. I'll keep it in mind as a counterexample when writing the devmanual patch.
