Protecting against downloads

[Matthew Farwell]

In article <1990Sep24.153529.8627 at naitc.naitc.com> karl at bbs.naitc.com (Karl Denninger) writes:

In our bbs, we have a chrooted environment.  Our passwd file in the
chrooted environment is a copy (with all passwords starred out, all
directories as /tmp and all shells as /bin/sorry (a c proggy which
prints out 'No shell available').  There are a few files which are
linked upwards.  2 are ascii messages which are catted (and only
catted), and there are the ttys.  These need to be linked upwards to
allow permissions to be transmitted when the user enters chrooted
environment.  This could be done by chmodding when they enter, but its
far easier this way.  People are only in the chrooted environment when
they are

1) Editing (not having the source to vi etc.)
2) Downloading (We have got the source to kermit/zmodem, but we want to
   be sure)

Everything else is done in a menu/command line driven environment, which
we wrote and we're pretty sure you can't get out of. Can anyone see any
problems with this?

>>>Without source code to "vi" there is NO WAY to prevent this.  Believe me.  
>>>I had this rather graphically illustrated to me once; it's a flaw in the
>>>way vi works.
>>Actually it's a feature of the way unix works - all the tools expect to
>>be able to include all the others. 
>Yeah, some feature.  It subverts the restricted shell instantly, and isn't
>well documented in the "Bugs" section of the manual (I believe that any tool
>which has this kind of property ought to make note of it in the manual
>pages at a minimum!)  Most people are unaware of the consequences of this
>"feature" and a number have gotten caught by it over the years.

I agree that it is actually a feature.  Its a pain when you need to
actually take the shell escapes out, but thats true of every editor when
you haven't got the source.  Look at emacs.  How would you restrict that
if you didn't have the source?  (how could you restrict emacs anyway???)
Its not a bug.  Its a feature.

This article has been written in vi, with judicious use of !}fmt^M.

Dylan.
-- 
Matthew J Farwell                 | Email: dylan at ibmpcug.co.uk
The IBM PC User Group, PO Box 360,|        ...!uunet!ukc!ibmpcug!dylan
Harrow HA1 4LQ England            | CONNECT - Usenet Access in the UK!!
Phone: +44 81-863-1191            | Sun? Don't they make coffee machines?