🚀 go-pugleaf

In article <1992Apr2.164218.3848@ecl.psu.edu> fenner@jazz.psu.edu (Bill Fenner) writes:
>|As for exiting to the shell from vi (or other editors).  Instead of
>|invoking vi just run a small program that does a 'chroot' and then
>|invokes vi.
>
>chrooted environments are difficult to set up.  If you chroot to
>/waffle/home/fenner, you can't exec /usr/ucb/vi; you would have to copy
>vi into everyone's home directory if you want them to run it.
>
>|And in their own directory, they can't do much harm at all!
>
>Yup.  If you can't do anything at all, then you can't do any harm.

Lest anybody accuses us of being biased, I should point out that we
are :)  Bill, I think, maintains bbstevie, an editor with
user-restriction facilities, and I've written a little chroot editor
shell.  Both should be available from the waffle archives, or you can
ask me for the chroot shell.

I don't think chroot environments are too hard to set up.  The way I
do it is to have a single chroot area for all users, and copy the file
they need to edit in and out of there, as necessary.

It does reduce editing flexibility a little bit-- a user can't read in
other files from their home directory-- but the security is pretty
much guaranteed and worry-free.

Also, a chroot shell allows you to drop in random editors as you like:
users on my system have three full-screen editors to choose from; all
were basically just copied out of my /usr/local/bin.

  --jh

-- 
John Hood, CU student, CU employee, and sometime BananaOp
jhood@albert.mannlib.cornell.edu,jhood@banana.ithaca.ny.us,jeh@crnlvax5.bitnet
By any reasonable computer's standard, I'm a virus.  So are you.