Hardening Apache by Tony Mobily phần 7

rằng họ tải các thư viện libc để tiết kiệm không gian trên đĩa cũng như trong bộ nhớ (nếu nó được chia sẻ, hầu hết các libc sẽ chỉ được chạy một lần, và sẽ được chia sẻ bởi tất cả các chương trình cần nó). Trong GNU / Linux, bạn có thể chạy ldd từ thư mục lib để chia sẻ các đối tượng hoặc thư viện động là cần thiết bởi một chương trình | that they load the libc library to save space on the disk as well as in memory if it is shared most of libc will only be run once and will be shared by all the programs needing it . In GNU Linux you can run ldd from the lib folder to see which shared objects or dynamic libraries are needed by a program root@localhost root Idd bin bash lib 0x4001c000 lib 0x40021000 lib i686 0x42000000 lib lib 0x40000000 root@localhost root Then you can create a lib directory in tmp jail and copy all the dynamic libraries needed into the jail root@localhost root root@localhost root root@localhost root root@localhost root root@localhost root root@localhost root mkdir tmp jail lib cd tmp jail lib cp lib . cp lib cp lib . cp lib . The ld-linux library in Linux also called loader loads dynamic libraries needed by some programs to run. It may seem ironic that these shared libraries are loaded by another shared library but that is because most programs need the loader which is about 3K in size. Having it as a shared object makes it easier to upgrade and saves a considerable amount of memory space. The libraries need to be in lib which is where the loader will look for them. This set of library files may vary for different systems. Now you can try to run your jailed bash root@localhost root chroot tmp jail bin bash This shows that the shell is present and is running in jail. At this point nothing will work except the built-in bash commands ls bash ls command not found cd bash cd root No such file or directory cd echo bin lib This is because none of these programs are available in the tmp jail directory. You can press Ctrl-D or type exit to leave the jailed shell. Another option is to copy useful programs into the jail possibly in bin so that they are available to the shell .