mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-03-07 14:18:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add some chroot clarifications.

Browse Source
This commit is contained in:
Kurt Zeilenga 2004-10-13 01:29:50 +00:00
parent 4e06e2d48c
commit c41d0eaf7c
1 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
doc/man/man8/slapd.8
View File

@ -155,28 +155,37 @@ which applies to add, delete, modify and modrdn), and execute operations
to anonymous users. to anonymous users.
.TP .TP
.BI \-r " directory" .BI \-r " directory"
Specifies a chroot "jail" directory. slapd will Specifies a directory to become the root directory. slapd will
.BR chdir (2) change the current working directory to this directory and
then then
.BR chroot (2) .BR chroot (2)
to this directory after opening listeners but before reading to this directory. This is done after opening listeners but before
any configuration file or initializing any backend. reading any configuration file or initializing any backend. When
used as a security mechanism, it should be used in conjunction with
.B -u
and
.B -g
options.
.TP .TP
.BI \-u " user" .BI \-u " user"
.B slapd .B slapd
will run slapd with the specified user name or id, and that user's will run slapd with the specified user name or id, and that user's
supplementary group access list as set with initgroups(3). The group ID supplementary group access list as set with initgroups(3). The group ID
is also changed to this user's gid, unless the -g option is used to is also changed to this user's gid, unless the -g option is used to
override. override. Note when used with
.TP .BR -r ,
.BI \-g " group" slapd will use the user database in the change root environment.
.B slapd
will run with the specified group name or id.
.LP .LP
Note that on some systems, running as a non-privileged user will prevent Note that on some systems, running as a non-privileged user will prevent
passwd back-ends from accessing the encrypted passwords. Note also that passwd back-ends from accessing the encrypted passwords. Note also that
any shell back-ends will run as the specified non-privileged user. any shell back-ends will run as the specified non-privileged user.
.TP .TP
.BI \-g " group"
.B slapd
will run with the specified group name or id. Note when used with
.BR -r ,
slapd will use the group database in the change root environment.
.TP
.BI \-c " cookie" .BI \-c " cookie"
This option provides a cookie for the syncrepl replication consumer. This option provides a cookie for the syncrepl replication consumer.
The cookie is a comma separated list of name=value pairs. The cookie is a comma separated list of name=value pairs.