Hi, This patch adds a chroot feature to nginx, which lighttpd and Apache have had for a while, and which would be useful to allow for the nginx binary and config files to live outside the jail directory.
# HG changeset patch # User opal hart <[email protected]> # Date 1487274704 0 # Thu Feb 16 19:51:44 2017 +0000 # Node ID 58e50038746aecdad10518afeccbfee66f91ac22 # Parent 05fd0dc8f0dc808219f727dd18a5da2f078c4073 Add 'chroot' config option and functionality diff -r 05fd0dc8f0dc -r 58e50038746a src/core/nginx.c --- a/src/core/nginx.c Thu Feb 16 18:37:22 2017 +0300 +++ b/src/core/nginx.c Thu Feb 16 19:51:44 2017 +0000 @@ -89,6 +89,13 @@ offsetof(ngx_core_conf_t, debug_points), &ngx_debug_points }, + { ngx_string("chroot"), + NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + 0, + offsetof(ngx_core_conf_t, chroot), + NULL }, + { ngx_string("user"), NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE12, ngx_set_user, @@ -1009,6 +1016,7 @@ * ccf->cpu_affinity_auto = 0; * ccf->cpu_affinity_n = 0; * ccf->cpu_affinity = NULL; + * ccf->chroot = NULL; */ ccf->daemon = NGX_CONF_UNSET; diff -r 05fd0dc8f0dc -r 58e50038746a src/core/ngx_cycle.h --- a/src/core/ngx_cycle.h Thu Feb 16 18:37:22 2017 +0300 +++ b/src/core/ngx_cycle.h Thu Feb 16 19:51:44 2017 +0000 @@ -101,6 +101,7 @@ ngx_uint_t cpu_affinity_n; ngx_cpuset_t *cpu_affinity; + ngx_str_t chroot; char *username; ngx_uid_t user; ngx_gid_t group; diff -r 05fd0dc8f0dc -r 58e50038746a src/os/unix/ngx_process_cycle.c --- a/src/os/unix/ngx_process_cycle.c Thu Feb 16 18:37:22 2017 +0300 +++ b/src/os/unix/ngx_process_cycle.c Thu Feb 16 19:51:44 2017 +0000 @@ -829,6 +829,20 @@ } if (geteuid() == 0) { + if (ccf->chroot.len) { + if (chdir((char *) ccf->chroot.data) == -1) { + ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno, + "chdir(%s) failed", ccf->chroot); + /* fatal */ + exit(2); + } + if (chroot((char *) ccf->chroot.data) == -1) { + ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno, + "chroot(%s) failed", (char *) ccf->chroot.data); + /* fatal */ + exit(2); + } + } if (setgid(ccf->group) == -1) { ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno, "setgid(%d) failed", ccf->group); -- wowaname http://wowana.me/pgp.htm _______________________________________________ nginx-devel mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx-devel
