Warning: This section has not been independently tested yet. Please read and use at your own risk. If you read it, please send feedback to Bobby Moretti (moretti@u.washington.edu).
If you are going to let the world use a Sage Notebook that you are serving from your computer, it is highly recommended you run it in a chroot jail. Otherwise a random user could easily delete all files that the local user running Sage has access to, and with more work could possibly hack into your computer.
This guide assumes that you want to put the chroot jail in /sage_chroot
.
Also, we assume you are using Debian GNU/Linux or a derivative thereof (such as
Ubuntu).
First, we make our image file. To do that, we run the command
$ dd if=/dev/zero of=/sage_chroot.image bs=1024 count=xxx
Verify that the command actually created the correct file size, for example:
$ ls -lh total 8.1G -rw-r--r-- 1 root root 8.0G 2006-06-09 18:18 sage_chroot.image
$ mke2fs -j sage_chroot.image
$ sudo vim /etc/fstab
/sage_chroot.image /sage_chroot ext3 bind 0 0
(Of course, the above values should be changed to reflect the directory location and filesystem type you chose previously.) Then finally to mount it we run:
$ sudo mount -a
Next we make a user that will run the chroot jailed Sage. Here we call it server.
$ adduser server ... ...
From this point, follow the guide at
https://wiki.ubuntu.com/DebootstrapChroot
/home
visible inside the chroot. This is not
what we want. However, to run something like Sage, we do want a
home directory for the server process. We would like to prevent denial of
service attacks from filling the entire disk.
Our solution is to simply use /sage_chroot/home/server
as the home
directory, mounting it to /home/server
. First we copy the home
directory's contents the chroot filesystem:
$ sudo cp -rpvf /home/server /sage_chroot/home/ $ sudo rm -rf /home/server/*
fstab
$ vim /etc/fstab
/tmp /sage_chroot/tmp none bind 0 0 /dev /sage_chroot/dev none bind 0 0 /sage_chroot/home/server /home/server none bind 0 0 proc-chroot /sage_chroot/proc proc defaults 0 0 devpts-chroot /sage_chroot/dev/pts devpts defaults 0 0
$ sudo mount -a
/etc/fstab
.
Now get Sage and install it to the desired subdirectory of /sage_chroot
:
$ cd ~ $ wget http://www.sagemath.org/dist/src/sage-x.y.z.tar $ cd /sage_chroot $ tar xvf ~/sage-x.y.z.tar $ mv sage-x.y.z/ sage/ $ cd sage $ make $ make clean
We also want to make it so only root can write to the files in the chroot environment. To do that, run
$ chmod og-w -R /sage_chroot/*
$ su - server
-
is very important. Sage will not run without a valid
HOME
variable). Then we run Sage from inside the jail with the dchroot
command:
$ dchroot -d /path/to/sage
/path/to/sage
is the Sage path from inside the chrooted
filesystem.
If all went well, you should be greeted by a Sage prompt. From here you can run the Sage notebook (or any other Sage with the peace of mind that it is sitting safely behind a chroot jail.
Keep in mind that the applications you have installed on your system will not be available for your chroot Sage to use. That is, if you have Octave or Mathematica installed, you will not be able to use them with your chroot Sage. (Note: in the case of Mathematica, this is a good thing, since it is illegal to provide free access to Mathematica over the web). If you do have extra packages you want to run with your chroot Sage, you need to install them from within the chroot environment.
See About this document... for information on suggesting changes.