Chroot is a little extreme. It locks the user into a completely isolated subset of the filesystem, which means he has to have his own copies of any files he might need to run. His PATH can't look outside the jail. This might be okay for single-function daemons, but it could be a nightmare for an interactive user (and the sysadmin).
(I mentioned before) Bash has an option called "restricted shell". It's a carryover from the old Bourne shell, and it can be enabled either by the "-r" option, or by invoking the (Bourne) shell as "rsh". In the case of Bash, you can use "rbash", but you have to create a symlink for rbash pointing to bash. For some reason, this isn't done in any of the systems I looked at. A use in a restricted shell can't chdir below his initial directory, but can access other directories via PATH. He also can't change his PATH and certain other options set via environment variables. > -----Original Message----- > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of > McKown, John > Sent: Friday, May 20, 2005 11:26 AM > To: [email protected] > Subject: Re: [LINUX-390] Linux default permissions > > > See if the following gives you any ideas: > > http://www.tjw.org/chroot-login-HOWTO/ > > It appears, on first reading, to force a user into a "chroot > jail" that > consists of their home directory. > > > -- > John McKown > Senior Systems Programmer > UICI Insurance Center > Information Technology > > This message (including any attachments) contains confidential > information intended for a specific individual and purpose, and its' > content is protected by law. If you are not the intended > recipient, you > should delete this message and are hereby notified that any > disclosure, > copying, or distribution of this transmission, or taking any action > based on it, is strictly prohibited. > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO > LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > -------------------------------------------------------- If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/ -------------------------------------------------------- ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
