[Jailkit-dev] [bug #64736] jk_update causes literal copy of passwd

[N247S]

URL:
  <https://savannah.nongnu.org/bugs/?64736>

                 Summary: jk_update causes literal copy of passwd
                   Group: Jailkit
               Submitter: n247s
               Submitted: Mon 02 Oct 2023 06:25:40 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Mon 02 Oct 2023 06:25:40 PM UTC By: N247S <n247s>
I noticed after running jk_update that a lot more files are 'updated' to a
jail than when initially setup with 'jk_init'.

One prominent thing I noticed is that a 'jk_init' will create a passwd file
with only the 'root' user and will append any jailed user effectively hiding
any potential user-info of other users.

The 'jk_update' however will simply copy over the whole passwd file, including
all the users etc..

Although there is not much security in hiding these additional users, it makes
for a much cleaner setup, and prevents any user-info present in the name
and/or home directory.







    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?64736>

_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/