Skip to content

Commit 79082c7

Browse files
wtarreauwtarreau
committed
MAJOR: startup: use chroot auto by default when available
3.4 implemented "chroot auto", "chroot /", unprivileged chroot and a warning for super-user when chroot is not used. We were not doing it for unprivileged users because this would have caused confusion with configs triggering warnings only on certain OSes or environments. Now's time to switch to automatic chroot attempt on startup whenever deemed possible. For this, we reuse the previous rules to decide to emit a warning when a chroot is possible but not done, and instead of complaining that no chroot is done, we just attempt it before emitting the warning only in case of failure. This is marked major because it may break some old rare configs that were emitting the warning in 3.4 due to the lack of chroot, when the user expected to access for example a UNIX socket at run time, or using an external check. The fix remains easy (and is explained in the warning), just use "chroot /". The change aims at increasing the default security level for users by default (i.e. with the least config settings), but it's not critical, so feedback will determine if we keep it as-is, if we adjust it, or if we revert it.
1 parent 7be73f6 commit 79082c7

2 files changed

Lines changed: 26 additions & 15 deletions

File tree

‎doc/configuration.txt‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2130,12 +2130,13 @@ chroot { <jail dir> | auto }
21302130
The resulting jail has no name in the filesystem and is empty and read-only,
21312131
removing the need to prepare a dedicated jail directory.
21322132

2133-
When starting with superuser privileges, a warning will be displayed if no
2134-
chroot is used, in order to encourage users to always use the mechanism. If
2135-
for any reason there is a compelling reason not to use chroot (e.g. access to
2136-
a server via a UNIX socket with an unconvenient path), it remains possible to
2137-
silence the warning by adding an explicit "chroot /", which has the benefit
2138-
of being visible in a configuration.
2133+
When starting with sufficient privileges, haproxy will automatically apply
2134+
"chroot auto" if no "chroot" directive is used, i.e. it will isolate itself
2135+
in a chroot jail, and will emit a warning if it fails to do so. If there is
2136+
a compelling reason not to use chroot (e.g. access to a server via a UNIX
2137+
socket outside of the jail), it remains possible to silence the warning by
2138+
adding an explicit "chroot /", which has the benefit of being visible in a
2139+
configuration.
21392140

21402141
close-spread-time <time>
21412142
Define a time window during which idle connections and active connections

‎src/haproxy.c‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3750,16 +3750,26 @@ int main(int argc, char **argv)
37503750
int chroot_permitted = geteuid() == 0;
37513751

37523752
#if defined(USE_PRCTL) && defined(PR_CAPBSET_READ) && defined(CAP_SYS_CHROOT)
3753-
chroot_permitted &= (prctl(PR_CAPBSET_READ, CAP_SYS_CHROOT, 0, 0, 0) == 1);
3754-
#endif
3755-
if (chroot_permitted) {
3753+
int ret = prctl(PR_CAPBSET_READ, CAP_SYS_CHROOT, 0, 0, 0);
3754+
if (ret == 1)
3755+
chroot_permitted = 1;
3756+
else if (ret == 0)
3757+
chroot_permitted = 0;
3758+
/* errors mean prctl() not supported, so don't update the verdict */
3759+
#endif
3760+
if (chroot_permitted && do_chroot(argv[0], "auto") != 0) {
37563761
ha_warning("[%s.main()] HAProxy was started as root without any 'chroot' "
3757-
"directive. A chroot limits filesystem access of an intruder "
3758-
"to a single, preferably empty, directory. It is strongly recommended "
3759-
"to enable this feature whenever possible (it's always possible when "
3760-
"starting as root), via 'chroot auto' in the global section. If you "
3761-
"think you have good reasons for running outside a chroot, explicitly "
3762-
"configure 'chroot /' to silence this warning.\n", argv[0]);
3762+
"directive, and an attempt at automatically chrooting failed, "
3763+
"so the haproxy process is not as protected as it could be. "
3764+
"Please report this event to developers with as many details as "
3765+
"possible about your execution environment so they can evaluate "
3766+
"if anything can be done to better support it. A chroot limits "
3767+
"filesystem access of an intruder to a single, preferably empty, "
3768+
"directory. It is strongly recommended to enable this feature "
3769+
"whenever possible (it's always possible when starting as root), "
3770+
"via 'chroot auto' in the global section. If you think you have "
3771+
"good reasons for running outside a chroot, explicitly configure "
3772+
"'chroot /' to silence this warning.\n", argv[0]);
37633773
}
37643774
}
37653775

0 commit comments

Comments
 (0)