Re: [IBMiOSS] Attempting chroot

The chroot command requires *ALLOBJ, unfortunately. The way around this is
to alter the HOMEDIR attribute on your profile so that when you log in via
ssh you will be sent directly to your chroot environment. The reason this
latter approach works is because the SSH daemon is running as a user with
*ALLOBJ (I am 90% sure that's the reason :-).

I've been toying with the idea of submitting an RFE to see if we can get
IBM to change the chroot permissions to only look at the new root directory
to see if the user has permission to it. At about that time I got
distracted with looking at Docker for i.

Aaron Bartell
IBM i hosting, starting at $157/month. litmis.com/spaces


On Wed, Jan 4, 2017 at 11:53 AM, <MWHopkins@xxxxxxxxxxxxxxx> wrote:

Hello,

I'm trying to set up a chroot environment for myself on my development
box. I followed the how_to here:

/QOpenSys/QIBM/ProdData/OPS/GCC/how_to_gcc-4.6.2..txt



Everything seemed to work fine setting up the chroot using a *secofr
profile with *allobj rights, but when I try to chroot as myself I get:

$ chroot /QOpenSys/mwh001 /QOpenSys/usr/bin/bsh

/QOpenSys/mwh001: The file access permissions do not allow the specified
action.



Not sure what permissions are incorrect, so I am looking for advice on
where to go.
I have rights to my chroot root in /QOpenSys

drwxrwsrwx 9 mwh001 0 8192 Jan 04 12:14 mwh001



And rights to the objects within it: /QOpenSys/mwh001

drwxrwsrwx 5 mwh001 0 8192 Jan 04 12:14 QOpenSys
lrwxrwxrwx 1 mwh001 0 34 Jan 04 10:08 bin ->
/QOpenSys/usr/bin
drwxrwsrwx 4 mwh001 0 8192 Jan 04 10:08 dev
drwxr-xr-x 4 mwh001 0 8192 Jan 04 12:16 etc
drwxrwsrwx 3 mwh001 0 8192 Jan 04 10:07 home
lrwxrwxrwx 1 mwh001 0 34 Jan 04 10:08 lib ->
/QOpenSys/usr/lib
lrwxrwxrwx 1 mwh001 0 26 Jan 04 12:14 opt ->
/QOpenSys/opt
lrwxrwxrwx 1 mwh001 0 36 Jan 04 10:08 sbin ->
/QOpenSys/usr/sbin
drwxrwsrwx 2 mwh001 0 8192 Jan 04 12:14 tmp
drwxrwsrwx 5 mwh001 0 8192 Jan 04 12:30 usr
drwxrwsrwx 3 mwh001 0 8192 Jan 04 12:16 var


Thanks,

Matt Hopkins
EDI/Web Services Developer
Information Technology
--
Web: www.pdpgroupinc.com
Email: MWHopkins@xxxxxxxxxxxxxxx
Office: 410-584-0330
Cell: 410-258-8845
Support: EDISupport@xxxxxxxxxxxxxxx
--
This is the IBMi Open Source Roundtable (OpenSource) mailing list
To post a message email: OpenSource@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/opensource
or email: OpenSource-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/opensource.