Add fchroot(2)

[trasz]

Summary

This is similar to chroot(2), but takes a file descriptor instead
of path. Same syscall exists in NetBSD and Solaris. It is part of a larger
patch to make absolute pathnames usable in Capsicum mode, but should
be useful in other contexts too.

Sponsored by: Innovate UK

[brooks]

I wonder if a chrootat(fd, path) that allows a NULL path would be more general?

Should there be a flags argument?

We do need to spend a capability bit on this?

I'm skeptical of the chroot(8) change. I don't see how it's useful in practice. If committed it should be separate from the syscall addition.

sys/kern/vfs_syscalls.c

1032

Need a struct fchroot_args definition. for consistency with the rest of the file.

usr.sbin/chroot/chroot.8

58–60 ↗

(On Diff #126417)

[trasz]

In D41564#950112, @brooks wrote:

I wonder if a chrootat(fd, path) that allows a NULL path would be more general?

Should there be a flags argument?

I'm not sure if I want to semantically mix "make this fd the new root" and "look up this path" bits. As it is now, it mimics fchdir(2). It's also compatible with NetBSD.

We do need to spend a capability bit on this?

Excellent question. I have no idea - my guess would be no, but because there already is CAP_FCHDIR, the purpose of which is also unclear to me, I simply followed suit.

I'm skeptical of the chroot(8) change. I don't see how it's useful in practice. If committed it should be separate from the syscall addition.

Agree - as it is now, it's mostly so that I can test the syscall by hand. Might become more useful in the future.

[trasz]

Update.

[trasz]

As for CAP_FCHROOT - I think we should have it, if only for symmetry with CAP_FCHDIR. I don't really want to implement them - the lookup code isn't really suited for tracking rights for root and cwd, and so those two syscalls require full rights to succeed, not just a subset - but we could in the future.

[trasz]

Add back procstat(1) bits and remove syscalls.map

[brooks]

lib/libsys/Symbol.sys.map

370

Should be FBSD_1.8

lib/libsys/chroot.2

33

Are multiple .Nm's valid?

[trasz]

Use the right symbol version and bump Dd.

[trasz]

lib/libsys/Symbol.sys.map

382–383

Btw, the entry for kcmp seems misaligned compared to syscalls in sections above.

lib/libsys/chroot.2

33

I think so, that's what eg chdir.2 or chmod.2 do. Although this made me realize I forgot to bump the date.

[brooks]

lib/libsys/chroot.2

101

sys/kern/syscalls.master

3344

Do you want to mark this CAPENABLED? It seems generally safe if pointless without the changes in D44373.

[trasz]

Improve the man page.

[trasz]

sys/kern/syscalls.master

3344

I think I'd prefer to to it later, together with fchdir(2).

[trasz]

So... how do we proceed with this?

[brooks]

A few more nits to address.

include/unistd.h

472

This is the wrong place. fchroot isn't part of XSI

lib/libsys/Symbol.sys.map

382–383

I've fixed this whitespace bug

lib/libsys/chroot.2

106

Presumably fchroot needs it's own error section with at least EBADF

sys/kern/syscalls.master

3346

[trasz]

Some more fixes from Brooks.