Include errors common to chroot and fchroot in a single list, followed by errors unique to each. Unprivileged chroot is permitted if the security.bsd.unprivileged_chroot sysctl is set to 1. Make note of this and update the EPERM description. Reported by: kevans
Details
Details
- Reviewers
kevans kib - Commits
- rG95f8c3e1ed0c: chroot.2: Update errors and unprivileged use
Diff Detail
Diff Detail
- Lint
Lint Skipped - Unit
Tests Skipped
Event Timeline
| lib/libsys/chroot.2 | ||
|---|---|---|
| 66 | I'd recommend noting the procctl(2) requirement as well- maybe this? | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 66 | Is it meant to say you can't chroot if the process has enabled NO_NEW_PRIVS? or something else? | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 66 | NO_NEW_PRIVS is the mechanism that blocks suid/sgid, so it must be toggled on before you can chroot(2) as non-root | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 118–119 | Which component? | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 118–119 | This is pretty standard wording for ENOTDIR among other system calls, any component of the path name for chroot(2). Did combining them into one list make it confusing? I can use ENOTDIR A component of the path name is not a directory. for chroot and ENOTDIR The file descriptor does not reference a directory. for fchroot. | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 118–119 | But there is no 'component of path' for fchdir, because there is no path. | |
| lib/libsys/chroot.2 | ||
|---|---|---|
| 118–119 | The same argument applies to EACCESS then, will undo combining that as well. | |
Comment Actions
style.mdoc(5) asks sysctls are Va so you can apropos them. I wonder if we can combine Ql and Va.