This ar­ti­cle de­scribes how to set up a fully ch­rooted Chero­kee server with a Django web site. This is cer­tainly not an ob­vi­ous task and I think oth­ers may find it use­ful, so here’s how to do it.

Set­ting up the ch­root en­vi­ron­ment

Be­fore con­tin­u­ing you propably should know what a ch­root is. In short, it is a folder that con­tains a Unix hi­er­ar­chy, just like the root of the file sys­tem. It will al­low us to run processes in­side that folder, iso­lated from the rest of the sys­tem.

We can jail the Chero­kee web server this way; this would make at­tack­ers un­able to ac­cess out­side re­sources.

So first you will need to cre­ate your ch­root di­rec­tory. I have choosen /srv to do it, but you can choose some­thing else if you pre­fer, I’ll just re­fer to it for the rest of the tu­to­r­ial.

I in­stall my ch­root in Arch­Linux us­ing my fa­vorite pack­age man­ager: pac­man.

If you use a dif­fer­ent dis­tri­b­u­tion, you can prob­a­bly use your pack­age man­ager, if it sup­ports ch­roots; al­ter­na­tively, it is good to know that you can still build a ch­root made of Arch­Linux pack­ages and use it, but you would have to build pac­man from source.

So let’s start. Here’s what we want to in­stall, in or­der:

• the base sys­tem: filesys­tem, core­utils, grep, sed, awk, perl, find­u­tils, file, bash, util-linux-ng, pam, shadow (maybe oth­ers)
• the django stuff: python, django, flup

In­stalling is done us­ing this com­mand:

# pacman -r /srv -Sy stuff

You may see er­rors when in­stalling filesys­tem, but it’s safe to ig­nore them.

The next step is to mount /tmp into the ch­root. This will make it shared be­tween the ch­root and the main sys­tem. This is be­cause some­times you need to ac­cess sock­ets through /tmp (/tmp/mysql.​sock for ex­am­ple). So add the fol­low­ing line to /etc/fstab:

/tmp /srv/tmp none bind 0 0

And mount it:

# mount /srv/tmp

Your ch­rooted apps will need some more files to work prop­erly.

• group, passwd, shadow: to make it aware of user ac­counts and groups
• resolv.​conf: make it able to re­solve host names

You can copy these files from your root en­vi­ron­ment but I pre­fer hard links:

# ln -f /etc/passwd /srv/etc/passwd
# ln -f /etc/group /srv/etc/group
# ln -f /etc/shadow /srv/etc/shadow
# ln -f /etc/resolv.conf /srv/etc/resolv.conf

Con­fig­ur­ing chero­kee

In Server Per­mis­sions, tell chero­kee to use /srv as the ch­root di­rec­tory. Be sure to also de­fine a user and group to drop per­mis­sions, be­cause ch­root­ing is pretty worth­less with­out it (un­less you use the gr­se­cu­rity patch­set).

That’s it. Make sure to al­ways use paths rel­a­tive to /srv in the chero­kee con­fig (i.e. /ht­docs in­stead of /srv/ht­docs).

Django stuff is a bit more dif­fi­cult to get work­ing right. For some rea­son, chero­kee will not ch­root your python scripts in­side /srv, so you will need some ex­tra magic to achieve this.

Sch­root (se­cure ch­root)

sch­root is a com­mand-line util­ity that lets you run scripts in a ch­root with re­duced priv­i­leges. In­stall it.

Edit /etc/sch­root/schroot.​conf and add a sec­tion to it. I call it /srv, the same as the di­rec­tory.

[/srv]
description=/srv
type=directory
location=/srv
priority=1
users=django_user
groups=http,django_user

Put your al­lowed users and groups here (which will run the python scripts). Cre­ate them if nec­es­sary.

Next, as­sum­ing you have your django site in /srv/http/mysite, you should be able to run:

# su django_user
# schroot -c /srv -d /http/mysite -- ./manage.py runfcgi \
method=threaded host=localhost port=8001 protocol=scgi

Make sure you have made manage.​py ex­e­cutable, it is not by de­fault. Af­ter it starts suc­cess­fully, kill the process.

# ps axu | grep fcgi
995      12956  [...] python ./manage.py runfcgi [...]
# kill 12956

Con­fig­ur­ing your django vir­tual host

In your chero­kee vir­tual host, set up your in­for­ma­tion like be­low:

Liq­uid er­ror: un­de­fined method `in­clude?’ for nil:Nil­Class

The com­mand-line you see is trun­cated, but it’s the same as above.

Now restart Chero­kee and that should be it. En­joy :)