Jul's page (Hungarian) : Jul's packages : imprison

The imprison program

Interface

     imprison
        [--root|-r new rootdir]
        [--caps|-c capability set]
        [--user|-u username]
        [--set-groups|-G]
        [--]
        command [arg [arg...]]

Arguments:

--root rootdir

changes root directory to rootdir. If you do this, you better drop uid 0, and/or at least cap_chroot.

--caps capability set

sets capability set as in cap_from_set(3). Beware that you can keep capabilities after you left uid 0.

--user username

drops uid 0 and sets uid and gid to username's uid/gid.

--set-groups

sets group's additional groups specified in /etc/group if user is set.

--

tells getopt_long(3) not to parse other options. Use this if you want to specify options to command.

command [arg [arg...]]

Command to run in jail. Mandatory.

Example

Imprison /usr/bin/id to an user bin:

    # imprison -u bin /usr/bin/id
    uid=1(bin) gid=1(bin) groups=1(bin)
    # imprison -u bin -G /usr/bin/id
    uid=1(bin) gid=1(bin) groups=1(bin),2(daemon),3(sys)

Imprison nc to a chroot(2) jail and bind to local port 50, running id with bin user and groups on every connection:

This assumes that execve(2) to nc keeps CAP_NET_BIND_SERVICE. This can be done with mandatory access control, or my patch (see kernel patches page).

    # mkdir -p jail/{bin,etc,lib}
    # cp /etc/{group,resolv.conf,ld.so.conf} jail/etc
    # cp /lib/{ld,libc}-*.so jail/lib
    # cp /usr/bin/id /usr/bin/nc jail/bin
    # ldconfig -r jail
    # imprison -u bin -G -r jail -c "cap_net_bind_service=ep" -- /bin/nc -l -p 50 -e /bin/id 127.1

    # telnet 0 50
    Trying 0.0.0.0...
    Connected to 0.
    Escape character is '^]'.
    uid=1 gid=1 groups=1,2,3
    Connection closed by foreign host.