Ticket #805: nginx-chroot.diff

src/core/nginx.c

@@ -49 +49 @@
       offsetof(ngx_core_conf_t, master),
       NULL },
 
+    { ngx_string("chroot"),
+      NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      0,
+      offsetof(ngx_core_conf_t, chroot),
+      NULL },
+
     { ngx_string("timer_resolution"),
       NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
       ngx_conf_set_msec_slot,
@@ -909 +916 @@
 #endif
     }
 
+    cycle->chroot.len = cycle->prefix.len;
+    cycle->chroot.data = ngx_pstrdup(cycle->pool, &cycle->prefix);
+
     if (ngx_conf_file) {
         cycle->conf_file.len = ngx_strlen(ngx_conf_file);
         cycle->conf_file.data = ngx_conf_file;
@@ -967 +977 @@
 
     ccf->daemon = NGX_CONF_UNSET;
     ccf->master = NGX_CONF_UNSET;
+    ccf->chroot = NGX_CONF_UNSET;
     ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
 
     ccf->worker_processes = NGX_CONF_UNSET;
@@ -995 +1006 @@
 
     ngx_conf_init_value(ccf->daemon, 1);
     ngx_conf_init_value(ccf->master, 1);
+    ngx_conf_init_value(ccf->chroot, 0);
     ngx_conf_init_msec_value(ccf->timer_resolution, 0);
 
     ngx_conf_init_value(ccf->worker_processes, 1);

src/core/ngx_cycle.c

@@ -94 +94 @@
         return NULL;
     }
 
+    if (old_cycle->chroot.data != NULL) {
+        cycle->chroot.len = old_cycle->chroot.len;
+        cycle->chroot.data = ngx_pstrdup(pool, &old_cycle->chroot);
+    }
+
     cycle->conf_file.len = old_cycle->conf_file.len;
     cycle->conf_file.data = ngx_pnalloc(pool, old_cycle->conf_file.len + 1);
     if (cycle->conf_file.data == NULL) {

src/core/ngx_cycle.h

@@ -68 +68 @@
     ngx_str_t                 conf_file;
     ngx_str_t                 conf_param;
     ngx_str_t                 conf_prefix;
+    ngx_str_t                 chroot;
     ngx_str_t                 prefix;
     ngx_str_t                 lock_file;
     ngx_str_t                 hostname;
@@ -77 +78 @@
 typedef struct {
      ngx_flag_t               daemon;
      ngx_flag_t               master;
+     ngx_flag_t               chroot;
 
      ngx_msec_t               timer_resolution;
 

src/http/ngx_http_core_module.c

@@ -4429 +4429 @@
 static char *
 ngx_http_core_root(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {
+    ngx_core_conf_t          *ccf;
     ngx_http_core_loc_conf_t *clcf = conf;
 
     ngx_str_t                  *value;
@@ -4437 +4438 @@
     ngx_http_script_compile_t   sc;
 
     alias = (cmd->name.len == sizeof("alias") - 1) ? 1 : 0;
+    ccf = (ngx_core_conf_t *)ngx_get_conf(cf->cycle->conf_ctx, ngx_core_module);
 
     if (clcf->root.data) {
 
@@ -4499 +4501 @@
         }
     }
 
+    if (ccf->chroot && clcf->root.len >= cf->cycle->chroot.len) {
+        u_char *chrootdir = cf->cycle->chroot.data;
+        chrootdir[cf->cycle->chroot.len] = '\0';
+
+        if (ngx_strnstr(clcf->root.data, (char *)chrootdir,
+            cf->cycle->chroot.len)) {
+            clcf->root.data += cf->cycle->chroot.len;
+            clcf->root.len -= cf->cycle->chroot.len;
+        }
+    }
+
     n = ngx_http_script_variables_count(&clcf->root);
 
     ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));

src/os/unix/ngx_process_cycle.c

@@ -828 +828 @@
     }
 
     if (geteuid() == 0) {
+        if (ccf->chroot) {
+            u_char *chrootdir = cycle->chroot.data;
+            chrootdir[cycle->chroot.len] = '\0';
+
+            if (chroot((const char *)chrootdir) == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "chroot(%s) failed", chroot);
+                exit(2);
+            }
+
+            if (chdir("/") == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "chdir failed");
+                exit(2);
+            }
+
+            cycle->prefix.data[0] = '\0';
+            cycle->prefix.len = 0;
+
+            ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "chrooted on %s", chrootdir);
+        }
+
         if (setgid(ccf->group) == -1) {
             ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
                           "setgid(%d) failed", ccf->group);