From: Kurt Zeilenga <kurt@openldap.org>
Date: Wed, 13 Oct 2004 01:29:50 +0000 (+0000)
Subject: Add some chroot clarifications.
X-Git-Tag: OPENLDAP_REL_ENG_2_3_0ALPHA~431
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=c41d0eaf7c7edc82b50417867814521f68d9c381;p=openldap

Add some chroot clarifications.
---

diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8
index c2b22931fc..6da01ff920 100644
--- a/doc/man/man8/slapd.8
+++ b/doc/man/man8/slapd.8
@@ -155,28 +155,37 @@ which applies to add, delete, modify and modrdn), and execute operations
 to anonymous users.
 .TP
 .BI \-r " directory"
-Specifies a chroot "jail" directory.  slapd will
-.BR chdir (2)
+Specifies a directory to become the root directory.  slapd will
+change the current working directory to this directory and
 then
 .BR chroot (2)
-to this directory after opening listeners but before reading
-any configuration file or initializing any backend.
+to this directory.  This is done after opening listeners but before
+reading any configuration file or initializing any backend.  When
+used as a security mechanism, it should be used in conjunction with
+.B -u
+and
+.B -g
+options.
 .TP
 .BI \-u " user"
 .B slapd
 will run slapd with the specified user name or id, and that user's
 supplementary group access list as set with initgroups(3).  The group ID
 is also changed to this user's gid, unless the -g option is used to
-override.
-.TP
-.BI \-g " group"
-.B slapd
-will run with the specified group name or id.
+override.  Note when used with
+.BR -r ,
+slapd will use the user database in the change root environment.
 .LP
 Note that on some systems, running as a non-privileged user will prevent
 passwd back-ends from accessing the encrypted passwords.  Note also that
 any shell back-ends will run as the specified non-privileged user.
 .TP
+.BI \-g " group"
+.B slapd
+will run with the specified group name or id.  Note when used with
+.BR -r ,
+slapd will use the group database in the change root environment.
+.TP
 .BI \-c " cookie"
 This option provides a cookie for the syncrepl replication consumer.
 The cookie is a comma separated list of name=value pairs.