aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin/chroot
Commit message (Collapse)AuthorAgeFilesLines
* manuals: Correct some sysctl markupAlexander Ziaee2026-01-061-1/+1
| | | | | | | | This enables additional searching the manual by sysctl variable. This syntax is standardized in style.mdoc(5). Reported by: bapt MFC after: 3 days
* kern: fix setgroups(2) and getgroups(2) to match other platformsKyle Evans2025-08-151-7/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | On most other platforms observed, including OpenBSD, NetBSD, and Linux, these system calls have long since been converted to only touching the supplementary groups of the process. This poses both portability and security concerns in porting software to and from FreeBSD, as this subtle difference is a landmine waiting to happen. Bugs have been discovered even in FreeBSD-local sources, since this behavior is somewhat unintuitive (see, e.g., fix 48fd05999b0f for chroot(8)). Now that the egid is tracked outside of cr_groups in our ucred, convert the syscalls to deal with only supplementary groups. Some remaining stragglers in base that had baked in assumptions about these syscalls are fixed in the process to avoid heartburn in conversion. For relnotes: application developers should audit their use of both setgroups(2) and getgroups(2) for signs that they had assumed the previous FreeBSD behavior of using the first element for the egid. Any calls to setgroups() to clear groups that used a single array of the now or soon-to-be egid can be converted to setgroups(0, NULL) calls to clear the supplementary groups entirely on all FreeBSD versions. Co-authored-by: olce (but bugs are likely mine) Relnotes: yes (see last paragraph) Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D51648
* chroot: don't setgroups() without -G having been specifiedKyle Evans2025-08-121-16/+25
| | | | | | | | | | | | | We previously would not have setgroups() at all, but now we would drop our supplementary groups every time. This broke chroot -n, probably among other things. We need tests here, but lets unbreak things first. A future change may try to setgroups(2) when -u is specified in addition to -G, so predicate the call on gidlist and don't populate that without a grouplist. PR: 288751 Fixes: 48fd05999b0f ("chroot: don't clobber the egid [...]")
* chroot: Remove always-true checksJohn Baldwin2025-08-071-2/+2
| | | | | | | | | | | | | | | | gid_t and uid_t are unsigned types, so the values are always >= 0. usr.sbin/chroot/chroot.c: In function 'resolve_group': usr.sbin/chroot/chroot.c:68:55: error: comparison of unsigned expression in '>= 0' is always true [-Werror=type-limits] 68 | if (errno == 0 && *endp == '\0' && (gid_t)gid >= 0 && gid <= GID_MAX) | ^~ usr.sbin/chroot/chroot.c: In function 'resolve_user': usr.sbin/chroot/chroot.c:87:55: error: comparison of unsigned expression in '>= 0' is always true [-Werror=type-limits] 87 | if (errno == 0 && *endp == '\0' && (uid_t)uid >= 0 && uid <= UID_MAX) | ^~ Reported by: GCC Fixes: 91eb4d2ba4de ("chroot: slightly cleanup")
* chroot: slightly cleanupKyle Evans2025-08-031-43/+51
| | | | | | | | | | | | | | | Highlights: - Pull resolve_user() and resolve_group() out to make the main flow a bit easier to read - Fix some edge-cases in user/group resolution: you can have fully numeric usernames, and they may or may not live within the valid ID range. Switch to just trying to resolve every specified group/user as a name, first, with a fallback to converting it to a numeric type and trying to resolve it as an ID. - Constify locals in main() that don't need to be mutable, re-sort Reviewed by: emaste, olce Differential Revision: https://reviews.freebsd.org/D51509
* chroot: Improve error message for unprivileged useEd Maste2025-08-011-1/+7
| | | | | | | | | | | | | | | | | | | | | | When the security.bsd.unprivileged_chroot sysctl is set, chroot(2) can be used by unprivileged users as long as the PROC_NO_NEW_PRIVS_CTL process control is set. chroot(8) has a -n command line flag to set this process control. Add an explicit error for EPERM from chroot(2) if the -n flag is necessary, but not present. Before: $ chroot / /bin/sh chroot: /: Operation not permitted After: $ chroot / /bin/sh chroot: unprivileged use requires -n Reviewed by: kevans Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D51687
* chroot.8: Be more precise when describing '-u', '-g' and '-G'Olivier Certner2025-07-281-6/+8
| | | | | | | Reviewed by: kevans, ziaee MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D51511
* chroot: don't clobber the egid with the first supplemental groupKyle Evans2025-07-261-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | There are two problems here, really: 1.) If -G is specified, the egid of the runner will get clobbered by the first supplemental group 2.) If both -G and -g are specified, the first supplemental group will get clobbered by the -g group Ideally our users shouldn't have to understand the quirks of our setgroups(2) and the manpage doesn't describe the group list as needing to contain the egid, so populate the egid slot as necessary. I note that this code seems to have already been marginally aware of the historical behavior because it was allocating NGROUPS_MAX + 1, but this is an artifact of a later conversion to doing dynamic allocations instead of pushing NGROUPS_MAX arrays on the stack -- the original code did in-fact only have an NGROUPS_MAX-sized array, and the layout was still incorrect. MFC after: 3 days Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D51508
* Remove residual blank line at start of MakefileWarner Losh2024-07-151-1/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* Remove copyright strings ifdef'd outWarner Losh2023-11-271-9/+0
| | | | | | | | | | | We've ifdef'd out the copyright strings for some time now. Go ahead and remove the ifdefs. Plus whatever other detritis was left over from other recent removals. These copyright strings are present in the comments and are largely from CSRG's attempt at adding their copyright to every binary file (which modern interpretations of the license doesn't require). Sponsored by: Netflix
* usr.sbin: Remove ancient SCCS tags.Warner Losh2023-11-273-6/+0
| | | | | | | | Remove ancient SCCS tags from the tree, automated scripting, with two minor fixup to keep things compiling. All the common forms in the tree were removed with a perl script. Sponsored by: Netflix
* Remove $FreeBSD$: one-line nroff patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\.\\"\s*\$FreeBSD\$$\n/
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-162-2/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* Mark usage function as __dead2 in programs where it does not returnAlfonso Gregory2023-07-071-1/+1
| | | | | | | | In most cases, usage does not return, so mark them as __dead2. For the cases where they do return, they have not been marked __dead2. Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/735
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-191-1/+0
|
* chroot: fix typo in usageEdward Tomasz Napierala2021-07-211-5/+5
| | | | | | While here also fix typo in a variable name. Reported By: oshogbo
* Implement unprivileged chrootEdward Tomasz Napierala2021-07-202-4/+29
| | | | | | | | | | | | | | | This builds on recently introduced NO_NEW_PRIVS flag to implement unprivileged chroot, enabled by `security.bsd.unprivileged_chroot`. It allows non-root processes to chroot(2), provided they have the NO_NEW_PRIVS flag set. The chroot(8) utility gets a new flag, -n, which sets NO_NEW_PRIVS before chrooting. Reviewed By: kib Sponsored By: EPSRC Relnotes: yes Differential Revision: https://reviews.freebsd.org/D30130
* Chroot first appeared in 4.3-Reno, not in 4.4 in the BSD world,Warner Losh2020-06-261-2/+4
| | | | | | | | | | | | | | but in System III in the AT&T world. Examination of the TUHS archives shows this was present in 4.3-Reno and System III. Reviewed by: 0mp@, allanjude@ MFC After: 3 days Differential Revision: https://reviews.freebsd.org/D25479 Notes: svn path=/head/; revision=362665
* chroot.8: Add examples & clean upMateusz Piotrowski2019-03-141-18/+40
| | | | | | | | | | | | | | | | | - Sort arguments in synopsis. - Clarify that it is possible to specify arguments to the command (and that they could be passed as further arguments to chroot(1)). - Standardize the description of the flags. - Improve formatting (e.g., do not use macros in strings specifying width). - Add examples. Reviewed by: bcr Approved by: bcr (doc) Approved by: krion (mentor, implicit), mat (mentor, implicit) Differential Revision: https://reviews.freebsd.org/D19582 Notes: svn path=/head/; revision=345132
* General further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-201-1/+3
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326025
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Renumber copyright clause 4Warner Losh2017-02-282-2/+2
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* Add META_MODE support.Simon J. Gerraty2015-06-131-0/+18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp Notes: svn path=/head/; revision=284345
| * dirdeps.mk now sets DEP_RELDIRSimon J. Gerraty2015-06-081-2/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284172
| * Updated dependenciesSimon J. Gerraty2014-05-161-1/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=266219
| * Updated dependenciesSimon J. Gerraty2014-05-101-0/+2
| | | | | | | | Notes: svn path=/projects/bmake/; revision=265802
| * Updated dependenciesSimon J. Gerraty2013-03-111-0/+1
| | | | | | | | Notes: svn path=/projects/bmake/; revision=248169
| * Updated dependenciesSimon J. Gerraty2013-02-161-2/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=246868
| * Sync from headSimon J. Gerraty2012-11-041-1/+1
| |\ | |/ |/| | | Notes: svn path=/projects/bmake/; revision=242545
| * Sync FreeBSD's bmake branch with Juniper's internal bmake branch.Marcel Moolenaar2012-08-221-0/+19
| | | | | | | | | | | | | | Requested by: Simon Gerraty <sjg@juniper.net> Notes: svn path=/projects/bmake/; revision=239572
* | Minor mdoc fixes.Joel Dahl2012-10-071-1/+1
|/ | | | Notes: svn path=/head/; revision=241330
* Eliminate global variables.Ed Schouten2011-11-061-5/+2
| | | | | | | | | There is no reason why these three variables should be declared as global variables, while the others aren't. They are only used inside main(). Notes: svn path=/head/; revision=227223
* The last big commit: let usr.sbin/ use WARNS=6 by default.Ed Schouten2010-01-021-2/+0
| | | | Notes: svn path=/head/; revision=201390
* ANSIfy some more tools in usr.sbin/.Ed Schouten2010-01-021-4/+2
| | | | | | | | Most of these tools build with WARNS=6, except for their use of K&R function declarations. Notes: svn path=/head/; revision=201387
* In preparation for raising NGROUPS and NGROUPS_MAX, change baseBrooks Davis2009-06-191-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | system callers of getgroups(), getgrouplist(), and setgroups() to allocate buffers dynamically. Specifically, allocate a buffer of size sysconf(_SC_NGROUPS_MAX)+1 (+2 in a few cases to allow for overflow). This (or similar gymnastics) is required for the code to actually follow the POSIX.1-2008 specification where {NGROUPS_MAX} may differ at runtime and where getgroups may return {NGROUPS_MAX}+1 results on systems like FreeBSD which include the primary group. In id(1), don't pointlessly add the primary group to the list of all groups, it is always the first result from getgroups(). In principle the old code was more portable, but this was only done in one of the two places where getgroups() was called to the overall effect was pointless. Document the actual POSIX requirements in the getgroups(2) and setgroups(2) manpages. We do not yet support a dynamic NGROUPS, but we may in the future. MFC after: 2 weeks Notes: svn path=/head/; revision=194494
* Per letter dated July 22, 1999, delete clause 3 from code directlyWarner Losh2004-08-072-8/+0
| | | | | | | from Berkeley. Notes: svn path=/head/; revision=133248
* Allow the optional setting of a user, primary group, or grouplistMike Makonnen2003-06-072-6/+114
| | | | | | | | | | when chrooting. Obtained from: NetBSD MFC after: 4 weeks Notes: svn path=/head/; revision=115952
* Explicitly compare the values returned by chdir(2) and chroot(2) to -1.Mike Makonnen2003-06-021-1/+1
| | | | Notes: svn path=/head/; revision=115677
* Use __FBSDID over rcsid[]. Protect copyright[] where needed.David E. O'Brien2003-05-031-4/+4
| | | | Notes: svn path=/head/; revision=114601
* style.Makefile(5)David E. O'Brien2003-04-041-1/+2
| | | | Notes: svn path=/head/; revision=113091
* The .Nm utilityPhilippe Charnier2002-07-141-1/+1
| | | | Notes: svn path=/head/; revision=99968
* de-__P()Alfred Perlstein2002-07-111-1/+1
| | | | Notes: svn path=/head/; revision=99800
* Pedantry to satisfy the bin/34159 author.Ruslan Ermilov2002-03-151-5/+5
| | | | Notes: svn path=/head/; revision=92326
* Finish cleanup in chroot.c CSRG revision 5.6 by Keith BosticRuslan Ermilov2002-01-221-4/+0
| | | | | | | | | (never installed setuid, so don't need to reset the uid). PR: bin/34159 Notes: svn path=/head/; revision=89641
* Add xref to jail(8)Mike Pritchard2001-12-281-1/+2
| | | | | | | | PR: docs/33178 Submitted by: Tom Rhodes <darklogik@pittgoth.com> Notes: svn path=/head/; revision=88572
* Reorder WARNS line for style.Mike Heffner2001-12-101-2/+1
| | | | | | | Pointed out by: bde Notes: svn path=/head/; revision=87629
* WARNS=2 cleanup.Mike Heffner2001-12-092-1/+3
| | | | | | | | Submitted by: Maxime Henrion <mux@qualys.com> MFC after: 2 weeks Notes: svn path=/head/; revision=87579
* mdoc(7) police: removed HISTORY info from the .Os call.Ruslan Ermilov2001-07-101-1/+1
| | | | Notes: svn path=/head/; revision=79537
* Fix the type of the NULL arg to execl()Brian Somers2001-07-091-1/+1
| | | | | | | Idea from: Theo de Raadt <deraadt@openbsd.org> Notes: svn path=/head/; revision=79452
generated by cgit v1.3 (git 2.53.0) at 2026-09-05 22:07:02 +0000