खुद को कभी भी जिंक का उपयोग नहीं करने के बाद, मैं केवल संकेत दे
सकता हूं कि मैं आमतौर पर ऐप्स को कैसे छेड़छाड़ करता हूं।
First step would be to gather information on everything the app
needs to run; this I usually accomplish by running systrace(1) and ldd(1) to find out what is needed to
run the software.
के आउटपुट के माध्यम से जाओ
systrace -A -d.
ldd
and make sure that everything the app touches and needs (quite a
lot of apps touch stuff it doesn't actually need) is available in
the chroot environment. You might need to tweak configs and
environment variables a bit. Also, if there is an option to have
the app log to syslog, I usually do that and create a syslog socket
(see the -a option of syslogd(8)) in order to decrease the
places the app needs write access to.
What I just described is a generic way to make just about any
program run in a chroot environment (however, if you need to import
half the userland and some suid commands, you might want to just
not do chroot :). For apps running under Apache (I'm sure you're
aware that the OpenBSD httpd(8) is slightly different) you
have the option (once the program has started; any dynamic
libraries still needs to be present in the jail) of using apache to
access the files, allowing the use of httpd.conf to import resources in the
chroot environment without actually copying them.
भी उपयोगी (अगर थोड़ा पुराना है) यह लिंक, रूपरेखा है OpenBSD पर chrooted
PHP में कुछ gotchas।