cherokee / webserver

Cherokee Web Server
GNU General Public License v2.0
562 stars 105 forks source link

rrdtool binaries have to be inside the jail if using chroot #755

Open danielniccoli opened 11 years ago

danielniccoli commented 11 years ago

Original author: jrabbit....@googlemail.com (November 27, 2010 18:40:24)

If you have uesd the chroot feature, the rrdtool binaries and 24 shared libraries have to be copied inside the chroot jail. It would be more secure if cherokee could open them from outside the jail before performing the chroot.

Additionally, the path to the rrd database is relative to the chroot path when cherokee writes the datafiles, but the same path is used relative to the real server root folder by cherokee-admin when trying to render the graphs.

Therefore, for graphs to work you have to create a symbolic link outside the jail to the folder inside the jail so that both applications can see the data on the configured path.

Original issue: http://code.google.com/p/cherokee/issues/detail?id=1057

danielniccoli commented 11 years ago

From goo...@ingostruck.de on March 10, 2011 18:19:13 For the former problem I propose a full static rrdtool build to be put into the jail. A script to achieve this is not that easy to setup, but I will provide one soon.

For the latter issue I propose the following patch. It injects the chroot base path into cherokee-admin, if present in the config file.