1*242be47eSzrj.\" Copyright (c) 2003 Networks Associates Technology, Inc. 2*242be47eSzrj.\" All rights reserved. 3*242be47eSzrj.\" 4*242be47eSzrj.\" Portions of this software were developed for the FreeBSD Project by 5*242be47eSzrj.\" ThinkSec AS and NAI Labs, the Security Research Division of Network 6*242be47eSzrj.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 7*242be47eSzrj.\" ("CBOSS"), as part of the DARPA CHATS research program. 8*242be47eSzrj.\" 9*242be47eSzrj.\" Redistribution and use in source and binary forms, with or without 10*242be47eSzrj.\" modification, are permitted provided that the following conditions 11*242be47eSzrj.\" are met: 12*242be47eSzrj.\" 1. Redistributions of source code must retain the above copyright 13*242be47eSzrj.\" notice, this list of conditions and the following disclaimer. 14*242be47eSzrj.\" 2. Redistributions in binary form must reproduce the above copyright 15*242be47eSzrj.\" notice, this list of conditions and the following disclaimer in the 16*242be47eSzrj.\" documentation and/or other materials provided with the distribution. 17*242be47eSzrj.\" 3. The name of the author may not be used to endorse or promote 18*242be47eSzrj.\" products derived from this software without specific prior written 19*242be47eSzrj.\" permission. 20*242be47eSzrj.\" 21*242be47eSzrj.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22*242be47eSzrj.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23*242be47eSzrj.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24*242be47eSzrj.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25*242be47eSzrj.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26*242be47eSzrj.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27*242be47eSzrj.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28*242be47eSzrj.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29*242be47eSzrj.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30*242be47eSzrj.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31*242be47eSzrj.\" SUCH DAMAGE. 32*242be47eSzrj.\" 33*242be47eSzrj.\" $FreeBSD: src/lib/libpam/modules/pam_chroot/pam_chroot.8,v 1.4 2004/07/02 23:52:16 ru Exp $ 34*242be47eSzrj.\" 35*242be47eSzrj.Dd February 10, 2003 36*242be47eSzrj.Dt PAM_CHROOT 8 37*242be47eSzrj.Os 38*242be47eSzrj.Sh NAME 39*242be47eSzrj.Nm pam_chroot 40*242be47eSzrj.Nd Chroot PAM module 41*242be47eSzrj.Sh SYNOPSIS 42*242be47eSzrj.Op Ar service-name 43*242be47eSzrj.Ar module-type 44*242be47eSzrj.Ar control-flag 45*242be47eSzrj.Pa pam_chroot 46*242be47eSzrj.Op Ar arguments 47*242be47eSzrj.Sh DESCRIPTION 48*242be47eSzrjThe chroot service module for PAM chroots users into either a 49*242be47eSzrjpredetermined directory or one derived from their home directory. 50*242be47eSzrjIf a user's home directory as specified in the 51*242be47eSzrj.Vt passwd 52*242be47eSzrjstructure returned by 53*242be47eSzrj.Xr getpwnam 3 54*242be47eSzrjcontains the string 55*242be47eSzrj.Dq Li /./ , 56*242be47eSzrjthe portion of the directory name to the left of that string is used 57*242be47eSzrjas the chroot directory, and the portion to the right will be the 58*242be47eSzrjcurrent working directory inside the chroot tree. 59*242be47eSzrjOtherwise, the directories specified by the 60*242be47eSzrj.Cm dir 61*242be47eSzrjand 62*242be47eSzrj.Cm cwd 63*242be47eSzrjoptions (see below) are used. 64*242be47eSzrj.Bl -tag -width ".Cm also_root" 65*242be47eSzrj.It Cm also_root 66*242be47eSzrjDo not hold user ID 0 exempt from the chroot requirement. 67*242be47eSzrj.It Cm always 68*242be47eSzrjReport a failure if a chroot directory could not be derived from the 69*242be47eSzrjuser's home directory, and the 70*242be47eSzrj.Cm dir 71*242be47eSzrjoption was not specified. 72*242be47eSzrj.It Cm cwd Ns = Ns Ar directory 73*242be47eSzrjSpecify the directory to 74*242be47eSzrj.Xr chdir 2 75*242be47eSzrjinto after a successful 76*242be47eSzrj.Xr chroot 2 77*242be47eSzrjcall. 78*242be47eSzrj.It Cm dir Ns = Ns Ar directory 79*242be47eSzrjSpecify the chroot directory to use if one could not be derived from 80*242be47eSzrjthe user's home directory. 81*242be47eSzrj.El 82*242be47eSzrj.Sh SEE ALSO 83*242be47eSzrj.Xr pam.conf 5 , 84*242be47eSzrj.Xr pam 8 85*242be47eSzrj.Sh AUTHORS 86*242be47eSzrjThe 87*242be47eSzrj.Nm 88*242be47eSzrjmodule and this manual page were developed for the 89*242be47eSzrj.Fx 90*242be47eSzrjProject by 91*242be47eSzrjThinkSec AS and NAI Labs, the Security Research Division of Network 92*242be47eSzrjAssociates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035 93*242be47eSzrj.Pq Dq CBOSS , 94*242be47eSzrjas part of the DARPA CHATS research program. 95