diff --git a/repos/os/src/server/chroot/README b/repos/os/src/server/chroot/README index df8bd9754..18af1bfe1 100644 --- a/repos/os/src/server/chroot/README +++ b/repos/os/src/server/chroot/README @@ -1,37 +1,14 @@ This component intercepts File_system requests and changes -the root directory of the request using the session label. +the root directory attached to requests as defined by +policy or by converting session label elements to a +hierarchy of directories. -In this example if cli_monitor had a child named "X", every -file system session from "X" would be rooted to the directory -"/cli_monitor/X" at "fs_server". +Sessions matching policies with _path_ attributes will be "chrooted" to the +configured policy path, sessions not matching policies with _path_ attributes +will be chrooted into paths formed from each session label element. Sessions +requests are downgraded to read-only requests unless matched by polices +with an affirmative _writeable_ attribute. Sessions not matching any +policy are rejected. -! -! -! ... -! -! -! -! -! -! -! -! -! -! -! -! -! ... -! -! -! -! -! -! -! -! -! ... -! - -In addition, the 'chroot' component will intercept the 'writeable' session -argument and only if its own policy allows it (i.e. the 'writeable' attribute -is to 'yes') the child is permitted to create a writeable connection. +Please note that this server is only effective for File_system servers that +honor the "root" or "writeable" argument to session requests. diff --git a/repos/os/src/server/chroot/component.cc b/repos/os/src/server/chroot/component.cc index 577271b6b..6e9baeac7 100644 --- a/repos/os/src/server/chroot/component.cc +++ b/repos/os/src/server/chroot/component.cc @@ -116,26 +116,8 @@ struct Chroot::Main if (policy.has_attribute("path")) { policy.attribute("path").value(tmp, sizeof(tmp)); root_path.import(tmp); - } - - /* if policy specifies a merge, use a truncated label */ - else if (policy.has_attribute("label_prefix") - && policy.attribute_value("merge", false)) - { - /* merge at the next element */ - size_t offset = policy.attribute("label_prefix").value_size(); - for (size_t i = offset; i < label.length()-4; ++i) { - if (strcmp(label.string()+i, " -> ", 4)) - continue; - - strncpy(tmp, label.string(), min(sizeof(tmp), i+1)); - break; - } - root_path = path_from_label(tmp); - } - - /* use an implicit chroot path from the label */ - else { + } else { + /* generate implicit chroot path from the label */ root_path = path_from_label(label.string()); }