Re: [IBMiOSS] Attempting chroot

[Aaron Bartell <aaronbartell@xxxxxxxxx>]

The chroot command requires *ALLOBJ, unfortunately.  The way around this is
to alter the HOMEDIR attribute on your profile so that when you log in via
ssh you will be sent directly to your chroot environment.  The reason this
latter approach works is because the SSH daemon is running as a user with
*ALLOBJ (I am 90% sure that's the reason :-).

I've been toying with the idea of submitting an RFE to see if we can get
IBM to change the chroot permissions to only look at the new root directory
to see if the user has permission to it.  At about that time I got
distracted with looking at Docker for i.

Aaron Bartell
IBM i hosting, starting at $157/month.  litmis.com/spaces


On Wed, Jan 4, 2017 at 11:53 AM, <MWHopkins@xxxxxxxxxxxxxxx> wrote:

> Hello,
>
> I'm trying to set up a chroot environment for myself on my development
> box. I followed the how_to here:
>
> /QOpenSys/QIBM/ProdData/OPS/GCC/how_to_gcc-4.6.2..txt
>
>
>
> Everything seemed to work fine setting up the chroot using a *secofr
> profile with *allobj rights, but when I try to chroot as myself I get:
>
> $ chroot /QOpenSys/mwh001 /QOpenSys/usr/bin/bsh
>
> /QOpenSys/mwh001: The file access permissions do not allow the specified
> action.
>
>
>
> Not sure what permissions are incorrect, so I am looking for advice on
> where to go.
> I have rights to my chroot root in /QOpenSys
>
> drwxrwsrwx    9 mwh001   0              8192 Jan 04 12:14 mwh001
>
>
>
> And rights to the objects within it:  /QOpenSys/mwh001
>
> drwxrwsrwx    5 mwh001   0              8192 Jan 04 12:14 QOpenSys
> lrwxrwxrwx    1 mwh001   0                34 Jan 04 10:08 bin ->
> /QOpenSys/usr/bin
> drwxrwsrwx    4 mwh001   0              8192 Jan 04 10:08 dev
> drwxr-xr-x    4 mwh001   0              8192 Jan 04 12:16 etc
> drwxrwsrwx    3 mwh001   0              8192 Jan 04 10:07 home
> lrwxrwxrwx    1 mwh001   0                34 Jan 04 10:08 lib ->
> /QOpenSys/usr/lib
> lrwxrwxrwx    1 mwh001   0                26 Jan 04 12:14 opt ->
> /QOpenSys/opt
> lrwxrwxrwx    1 mwh001   0                36 Jan 04 10:08 sbin ->
> /QOpenSys/usr/sbin
> drwxrwsrwx    2 mwh001   0              8192 Jan 04 12:14 tmp
> drwxrwsrwx    5 mwh001   0              8192 Jan 04 12:30 usr
> drwxrwsrwx    3 mwh001   0              8192 Jan 04 12:16 var
>
>
> Thanks,
>
> Matt Hopkins
> EDI/Web Services Developer
> Information Technology
> --
> Web: www.pdpgroupinc.com
> Email: MWHopkins@xxxxxxxxxxxxxxx
> Office: 410-584-0330
> Cell: 410-258-8845
> Support: EDISupport@xxxxxxxxxxxxxxx
> --
> This is the IBMi Open Source Roundtable (OpenSource) mailing list
> To post a message email: OpenSource@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/opensource
> or email: OpenSource-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/opensource.