Re: git-daemon --inetd

From: H. Peter Anvin <hpa@zytor.com>
Date: Sep 16, 2005, 18:23 UTC
Message-ID: <432B0D97.2030903@zytor.com>
In-Reply-To: <Pine.LNX.4.58.0509161027460.26803@g5.osdl.org>

Linus Torvalds wrote:

Show 10 quoted lines

> 
> Well, the symbolic names are much nicer and more readable. So it would be 
> better to do the uid/gid translation early, and change the "chroot" thing 
> to be done after all that.
> 
> It gets a bit messy.. Easy enough to just save a "const char *new_root",
> but then you have to split up the "set_user_group()" to be two functions,
> around the actual chroot(), since the chroot needs to be done while we're
> still root.
>

Actually, initgroups() and setgroups(), and setgid() for that matter, can be done before the chroot(). The only thing that needs to remain until the end is setuid().

At one time I played around in tftp-hpa with trying to get Linux to keep only CAP_SYS_CHROOT around, but I think I gave up on it. The way Linux capabilities play with the rest of the permission system isn't very useful :(

	-hpa