Я бы хотел бежать dhcpd3 из тюрьмы chroot на Debian Lenny. На данный момент я могу запустить его как root из своей тюрьмы.
Теперь я хочу сделать это как пользователь без полномочий root (как параметр привязки "-u blah -t / path / to / jail").
Если я начну свой процесс так:
start-stop-daemon --chroot /home/jails/dhcp --chuid dhcp \ --start --pidfile /home/jails/dhcp/var/run/dhcp.pid --exec /usr/sbin/dhcpd3
Я застреваю с этими ошибками:
Internet Systems Consortium DHCP Server V3.1.1 Copyright 2004-2008 Internet Systems Consortium. All rights reserved. For info, please visit http://www.isc.org/sw/dhcp/ unable to create icmp socket: Operation not permitted Wrote 0 deleted host decls to leases file. Wrote 0 new dynamic host decls to leases file. Wrote 0 leases to leases file. Open a socket for LPF: Operation not permitted
strace:
brk(0) = 0x911b000
fcntl64(0, F_GETFD) = 0
fcntl64(1, F_GETFD) = 0
fcntl64(2, F_GETFD) = 0
access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb775d000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/tls/i686/cmov", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/tls/i686/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/tls/i686", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/tls/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/tls/cmov", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/tls/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/tls", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i686/cmov", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/i686/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i686", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/cmov", 0xbfc2ac84) = -1 ENOENT (No such file or directory)
open("/lib/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1\0004\0\0\0t"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1294572, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb775c000
mmap2(NULL, 1300080, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb761e000
mmap2(0xb7756000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x138) = 0xb7756000
mmap2(0xb7759000, 9840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7759000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb761d000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb761d6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7756000, 4096, PROT_READ) = 0
open("/dev/null", O_RDWR) = 3
close(3) = 0
brk(0) = 0x911b000
brk(0x913c000) = 0x913c000
socket(PF_FILE, SOCK_DGRAM, 0) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
connect(3, {sa_family=AF_FILE, path="/dev/log"...}, 110) = 0
time(NULL) = 1284760816
open("/etc/localtime", O_RDONLY) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
fstat64(4, {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb761c000
read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0\0\0\0\0"..., 4096) = 2945
_llseek(4, -28, [2917], SEEK_CUR) = 0
read(4, "\nCET-1CEST,M3.5.0,M10.5.0/3\n"..., 4096) = 28
close(4) = 0
munmap(0xb761c000, 4096) = 0
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Intern"..., 73, MSG_NOSIGNAL) = 73
write(2, "Internet Systems Consortium DHCP "..., 46Internet Systems Consortium DHCP Server V3.1.1) = 46
write(2, "\n"..., 1
) = 1
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Copyri"..., 75, MSG_NOSIGNAL) = 75
write(2, "Copyright 2004-2008 Internet Syst"..., 48Copyright 2004-2008 Internet Systems Consortium.) = 48
write(2, "\n"..., 1
) = 1
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: All ri"..., 47, MSG_NOSIGNAL) = 47
write(2, "All rights reserved."..., 20All rights reserved.) = 20
write(2, "\n"..., 1
) = 1
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: For in"..., 77, MSG_NOSIGNAL) = 77
write(2, "For info, please visit http://www"..., 50For info, please visit http://www.isc.org/sw/dhcp/) = 50
write(2, "\n"..., 1
) = 1
socket(PF_FILE, SOCK_STREAM, 0) = 4
fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = -1 ENOENT (No such file or directory)
close(4) = 0
socket(PF_FILE, SOCK_STREAM, 0) = 4
fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0
connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = -1 ENOENT (No such file or directory)
close(4) = 0
open("/etc/nsswitch.conf", O_RDONLY) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=475, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb761c000
read(4, "# /etc/nsswitch.conf\n#\n# Example "..., 4096) = 475
read(4, ""..., 4096) = 0
close(4) = 0
munmap(0xb761c000, 4096) = 0
open("/lib/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/tls/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/tls/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/tls/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/tls", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/tls/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/tls/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/tls/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/tls/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/tls/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/tls/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/tls/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/tls", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/i486-linux-gnu/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/lib/i486-linux-gnu", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/tls/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/tls/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/tls/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/tls/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/tls/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/tls/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/tls/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/tls", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/i686/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/i686/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/i686/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/i686", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/cmov/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu/cmov", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/usr/lib/i486-linux-gnu/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/i486-linux-gnu", 0xbfc2ad5c) = -1 ENOENT (No such file or directory)
open("/lib/libnss_files.so.2", O_RDONLY) = 4
read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320\30\0\0004\0\0\0\250"..., 512) = 512
fstat64(4, {st_mode=S_IFREG|0644, st_size=38408, ...}) = 0
mmap2(NULL, 41624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7612000
mmap2(0xb761b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x8) = 0xb761b000
close(4) = 0
open("/etc/services", O_RDONLY|O_CLOEXEC) = 4
fcntl64(4, F_GETFD) = 0x1 (flags FD_CLOEXEC)
fstat64(4, {st_mode=S_IFREG|0644, st_size=18480, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7611000
read(4, "# Network services, Internet styl"..., 4096) = 4096
read(4, "9/tcp\t\t\t\t# Quick Mail Transfer Pr"..., 4096) = 4096
read(4, "note\t1352/tcp\tlotusnotes\t# Lotus "..., 4096) = 4096
read(4, "tion\nafs3-kaserver\t7004/udp\nafs3-"..., 4096) = 4096
read(4, "backup\t2989/tcp\t\t\t# Afmbackup sys"..., 4096) = 2096
read(4, ""..., 4096) = 0
close(4) = 0
munmap(0xb7611000, 4096) = 0
time(NULL) = 1284760816
open("/etc/protocols", O_RDONLY|O_CLOEXEC) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=2626, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7611000
read(4, "# Internet (IP) protocols\n#\n# Upd"..., 4096) = 2626
close(4) = 0
munmap(0xb7611000, 4096) = 0
socket(PF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Operation not permitted)
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: unable"..., 80, MSG_NOSIGNAL) = 80
write(2, "unable to create icmp socket: Ope"..., 53unable to create icmp socket: Operation not permitted) = 53
write(2, "\n"..., 1
) = 1
open("/etc/dhcp3/dhcpd.conf", O_RDONLY) = 4
lseek(4, 0, SEEK_END) = 1426
lseek(4, 0, SEEK_SET) = 0
read(4, "#----------------------------\n# G"..., 1426) = 1426
close(4) = 0
mmap2(NULL, 401408, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75b0000
mmap2(NULL, 401408, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb754e000
mmap2(NULL, 401408, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74ec000
brk(0x916f000) = 0x916f000
close(3) = 0
socket(PF_FILE, SOCK_DGRAM, 0) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
connect(3, {sa_family=AF_FILE, path="/dev/log"...}, 110) = 0
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Inter"..., 74, MSG_NOSIGNAL) = 74
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Copyr"..., 76, MSG_NOSIGNAL) = 76
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: All r"..., 48, MSG_NOSIGNAL) = 48
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: For i"..., 78, MSG_NOSIGNAL) = 78
open("/var/lib/dhcp3/dhcpd.leases", O_RDONLY) = 4
lseek(4, 0, SEEK_END) = 126
lseek(4, 0, SEEK_SET) = 0
read(4, "# The format of this file is docu"..., 126) = 126
close(4) = 0
open("/var/lib/dhcp3/dhcpd.leases", O_WRONLY|O_CREAT|O_APPEND, 0666) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=126, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74eb000
fstat64(4, {st_mode=S_IFREG|0644, st_size=126, ...}) = 0
_llseek(4, 126, [126], SEEK_SET) = 0
time(NULL) = 1284760816
time(NULL) = 1284760816
open("/var/lib/dhcp3/dhcpd.leases.1284760816", O_WRONLY|O_CREAT|O_TRUNC, 0664) = 5
fcntl64(5, F_GETFL) = 0x1 (flags O_WRONLY)
fstat64(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74ea000
_llseek(5, 0, [0], SEEK_CUR) = 0
close(4) = 0
munmap(0xb74eb000, 4096) = 0
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Wrote"..., 70, MSG_NOSIGNAL) = 70
write(2, "Wrote 0 deleted host decls to lea"..., 42Wrote 0 deleted host decls to leases file.) = 42
write(2, "\n"..., 1
) = 1
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Wrote"..., 74, MSG_NOSIGNAL) = 74
write(2, "Wrote 0 new dynamic host decls to"..., 46Wrote 0 new dynamic host decls to leases file.) = 46
write(2, "\n"..., 1
) = 1
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Wrote"..., 58, MSG_NOSIGNAL) = 58
write(2, "Wrote 0 leases to leases file."..., 30Wrote 0 leases to leases file.) = 30
write(2, "\n"..., 1
) = 1
write(5, "# The format of this file is docu"..., 126) = 126
fsync(5) = 0
unlink("/var/lib/dhcp3/dhcpd.leases~") = 0
link("/var/lib/dhcp3/dhcpd.leases", "/var/lib/dhcp3/dhcpd.leases~") = 0
rename("/var/lib/dhcp3/dhcpd.leases.1284760816", "/var/lib/dhcp3/dhcpd.leases") = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 4
ioctl(4, SIOCGIFCONF, {0 -> 64, NULL}) = 0
ioctl(4, SIOCGIFCONF, {64, {{"lo", {AF_INET, inet_addr("127.0.0.1")}}, {"eth0", {AF_INET, inet_addr("192.168.0.10")}}}}) = 0
ioctl(4, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
ioctl(4, SIOCGIFFLAGS, {ifr_name="eth0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0
ioctl(4, SIOCGIFHWADDR, {ifr_name="eth0", ifr_hwaddr=00:c0:26:87:55:c0}) = 0
socket(PF_PACKET, SOCK_PACKET, 768) = -1 EPERM (Operation not permitted)
time(NULL) = 1284760816
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0
send(3, "Sep 18 00:00:16 dhcpd: Open "..., 74, MSG_NOSIGNAL) = 74
write(2, "Open a socket for LPF: Operation "..., 46Open a socket for LPF: Operation not permitted) = 46
write(2, "\n"..., 1
) = 1
exit_group(1) = ?
Я это понимаю dhcpd хочет создать сокеты на порту 67 ... но я не знаю, как авторизовать это через chroot.
Любая идея?
Для привязки к портам <1024 вам обычно требуются права суперпользователя или возможность CAP_NET_BIND_SERVICE (видеть capabilities(7)).
Вы можете установить возможность CAP_NET_BIND_SERVICE с setcap утилита (pacakge libcap2-bin)