Give the code around chroot(2)/chdir(2) a major overhaul by

separating its part around chroot(2) from that around initial
chdir(2).  This makes the below changes really easy.

Move seteuid(to user's uid) to before calling chdir(2).  There are
two goals to achieve by that.  First, NFS mounted home directories
with restrictive permissions become accessible (local superuser
can't access them if not mapped to uid 0 on the remote side
explicitly.)  Second, all the permissions to the home directory
pathname components become effective; previously a user could be
carried to any local directory despite its permissions since the
chdir(2) was done with euid 0.  This reduces possible impact from
FTP server misconfiguration, e.g., assigning a wrong home directory
to a user.

Implement the "/./" feature.  Now a guest or user subject to chrooting
may have "/./" in his login directory, which separates his chroot
directory from his home directory inside the chrooted environment.
This works for ftpchroot(5) as well.

PR:		bin/17843 bin/23944

1 files changed, 16 insertions, 4 deletions

diff --git a/libexec/ftpd/ftpchroot.5 b/libexec/ftpd/ftpchroot.5
index 8c8f629..ec14715 100644
--- a/libexec/ftpd/ftpchroot.5
+++ b/libexec/ftpd/ftpchroot.5
@@ -66,9 +66,16 @@ A username is specified otherwise.
 The optional second field describes the directory for the user
 or each member of the group to be locked up in using
 .Xr chroot 2 .
+Be it omitted, the user's login directory will be used.
 If it is not an absolute pathname, then it will be relative
 to the user's login directory.
-Be this field omitted, the user's login directory will be used.
+If it contains the
+.Qq \&/./
+seprator,
+.Xr ftpd 8
+will treat its left-hand side as the name of the directory to do
+.Xr chroot 2
+to, and its right-hand side to change the current directory to afterwards.
 .Sh FILES
 .Bl -tag -width /etc/ftpchroot -compact
 .It Pa /etc/ftpchroot
@@ -86,12 +93,17 @@ webuser
 @hostee
 .Ed
 .Pp
-And this line will lock up the user
+And this line will tell
+.Xr ftpd 8
+to lock up the user
 .Qq joe
 in
-.Pa /var/spool/ftp :
+.Pa /var/spool/ftp
+and then to change the current directory to
+.Pa /joe ,
+which is relative to the session's new root:
 .Bd -literal -offset indent
-joe	/var/spool/ftp
+joe	/var/spool/ftp/./joe
 .Ed
 .Pp
 And finally the following line will lock up every user connecting