Re: [gentoo-dev] chroot USE flag?

[Christian Axelsson <smiler@lanil.mine.nu>]

[-- Attachment #1: Type: text/plain, Size: 1993 bytes --]

On Fri, 2003-07-18 at 02:49, Matt Rickard wrote:
> On 18 Jul 2003 01:15:00 -0400
> Brandon Hale <brandon@comp-u-tek.com> wrote:
> > I propose a new USE flag for a few key services that would install the
> > package in a chroot "out of the box." This idea was inspired by a
> > conversation between Greg Fitzgerald (gregf) and myself on applying
> > ideas from OpenBSD to Gentoo. Another source of inspiration is the
> > excelent pkg_config code in the latest bind9 ebuilds. I further
> > discussed this idea w/ memebers of the gentoo-hardened team and
> > further crystalized the workings of such a flag. I would propose that
> > the ebuild include two conditional install proceedures keyed on the
> > chroot USE flag. The only possible problem I forsee is building
> > devices inside the sandbox, which could be accomplished in
> > pkg_postinstall as a last resort. I would be happy for any feedback or
> > further development of this idea.
> 
> I think this is a good idea.  A chroot USE flag would allow daemons to
> be chrooted transparently without users having to manually ebuild
> config.  Chroot building could be done in the sandbox, and as Brandon
> mentioned, we could create the device files with pkg_postinst.  These
> could be removed with pkg_postrm explicitly.
> 
> Eventually I would like to see this USE flag apply to more daemons than
> just bind.  I don't know which other packages in portage currently have
> chrooting options (anyone help me out here?), but I'd at least like to
> see this for ntpd and apache to start.

PowerDNS is another, apache can run chrooted (but you loose a few
features, but on a production server those shouldnt be very important).
I bet there are many we-run-as-root servers out there that fairly easy
can be chrooted (actually in theory you can chroot almost all services).

I propose yes to this aswell.

-- 
Christan Axelsson 
  smiler@lanil.mine.nu

GPG key ID
  6C3C55D9 @ ldap://keyserver.pgp.com

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]