You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Many services use chroot() to improve security. Supporting specifying root directory in Airup service manifest could make the system more secure.
Unresolved Questions
Rust standard library haven't supported chroot-ing for child processes yet. However, when using pre_exec to reach the goal, setuid() is earlier called, causing user switching to be conflicted with chroot-ing (that's also why we commented setgroup()). Should we switch to use pre_exec for setuid(), too, in order to keep the order?
The text was updated successfully, but these errors were encountered:
Introduction
Many services use
chroot()
to improve security. Supporting specifying root directory in Airup service manifest could make the system more secure.Unresolved Questions
chroot
-ing for child processes yet. However, when usingpre_exec
to reach the goal,setuid()
is earlier called, causing user switching to be conflicted withchroot
-ing (that's also why we commentedsetgroup()
). Should we switch to usepre_exec
forsetuid()
, too, in order to keep the order?The text was updated successfully, but these errors were encountered: