This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
команда_chroot [2020/07/16 15:09] val [Тестирование изоляции процессов] |
команда_chroot [2024/04/26 09:46] (current) val [Debian/Ubuntu] |
||
---|---|---|---|
Line 31: | Line 31: | ||
cp /bin/cat /var/www/bin/ | cp /bin/cat /var/www/bin/ | ||
cp /usr/bin/file /var/www/usr/bin/ | cp /usr/bin/file /var/www/usr/bin/ | ||
+ | cp /usr/bin/date /var/www/usr/bin/ | ||
cp /usr/share/misc/magic.mgc /var/www/usr/share/misc/ | cp /usr/share/misc/magic.mgc /var/www/usr/share/misc/ | ||
Line 44: | Line 45: | ||
cp /lib/x86_64-linux-gnu/libc.so.* /var/www/lib/x86_64-linux-gnu/ | cp /lib/x86_64-linux-gnu/libc.so.* /var/www/lib/x86_64-linux-gnu/ | ||
cp /lib/x86_64-linux-gnu/libz.so.* /var/www/lib/x86_64-linux-gnu/ | cp /lib/x86_64-linux-gnu/libz.so.* /var/www/lib/x86_64-linux-gnu/ | ||
+ | #debian11_12 cp /lib/x86_64-linux-gnu/libbz2.so.* /var/www/lib/x86_64-linux-gnu/ | ||
+ | #debian12 cp /lib/x86_64-linux-gnu/liblz* /var/www/lib/x86_64-linux-gnu/ | ||
cp /usr/lib/x86_64-linux-gnu/libmagic.so.* /var/www/usr/lib/x86_64-linux-gnu/ | cp /usr/lib/x86_64-linux-gnu/libmagic.so.* /var/www/usr/lib/x86_64-linux-gnu/ | ||
</code><code> | </code><code> | ||
Line 50: | Line 53: | ||
=== Создание окружения через debootstrap === | === Создание окружения через debootstrap === | ||
+ | |||
+ | * [[https://wiki.debian.org/ru/Debootstrap]] | ||
+ | |||
<code> | <code> | ||
debian# apt install debootstrap | debian# apt install debootstrap | ||
Line 66: | Line 72: | ||
<code> | <code> | ||
# chroot /var/www/ /bin/bash | # chroot /var/www/ /bin/bash | ||
+ | или | ||
+ | # unshare -R /var/www /bin/bash | ||
# echo * | # echo * | ||
Line 76: | Line 84: | ||
</code> | </code> | ||
- | ==== Тестирование изоляции процессов ==== | ||
- | <code> | ||
- | # ps ax | ||
- | debian# mkdir /var/www/proc | ||
- | |||
- | debian# mount --bind /proc /var/www/proc | ||
- | |||
- | debian# chroot /var/www/ /bin/bash | ||
- | |||
- | chroot# echo /proc/* | ||
- | </code> | ||
===== shell inetd web сервер в chroot ===== | ===== shell inetd web сервер в chroot ===== | ||
* [[Сервис INETD]] | * [[Сервис INETD]] | ||
- | ==== Debian/Ubuntu/FreeBSD ==== | + | ==== Debian/Ubuntu==== |
<code> | <code> | ||
Line 103: | Line 100: | ||
... | ... | ||
base=/ | base=/ | ||
+ | log=/webd.log | ||
... | ... | ||
</code> | </code> | ||
+ | ===== Поиск всех процессов в chroot ===== | ||
- | ==== FreeBSD ==== | + | * [[https://support.cpanel.net/hc/en-us/articles/1500012454701-How-To-Find-The-List-Of-All-The-Chroot-ed-Processes-On-The-System|How To Find The List Of All The Chroot-ed Processes On The System?]] |
<code> | <code> | ||
- | # cat /etc/inetd.conf | + | for file in `find /proc/ -type l -name "root" -print 2> /dev/null | grep -Eiv /task/ 2> /dev/null`; do PID=`ls -d $file 2> /dev/null| awk -F "/" '{print $3}'` && printf "%s = %s = %s\n" "$PID" `ps -p "$PID" 2> /dev/null | tail -n1 | awk '{print $4}'` `readlink $file 2> /dev/null` | grep -Eiv "(= /$|^\s*=\s*$|^.*?=\s*$)";done |
- | </code><code> | + | |
- | ... | + | |
- | #http stream tcp nowait root /usr/local/sbin/webd webd | + | |
- | http stream tcp nowait root /usr/sbin/chroot chroot /var/www/ /sbin/webd | + | |
- | </code><code> | + | |
- | # service inetd restart | + | |
</code> | </code> | ||
+ |