Could you explain this “chroot” /tmp directory creation?

Question

In the following linked article they explain how to create a "chroot" /tmp directory. I'm a bit confused by what they did. Could someone explain what the following commands are doing?

Noexec and /tmp Troubleshooting

1. # mkdir -p /root/chroot /root/tmp 
2. # mount --bind / /root/chroot 
3. # mount --bind /root/tmp /root/chroot/tmp
4. # chroot /root/chroot

In the first step, why did they create /root/tmp and not /root/chroot/tmp?

Does the first mount command affects the second one? On the second step they are binding the new directory /root/chroot to the root directory. Does that mean that on the third step /root/tmp actually points to /root/chroot/root/tmp ? Where does /root/chroot/tmp comes from? That's the part I'm getting confused.

What's the logic behind this?

Answer 1

In step 2 you bind mounted / on /root/chroot.

If you create step 2.5 as ls /root/chroot you'll find all the directories of / listed; including the system's /tmp directory.

If you touch /root/chroot/test you'll see that test is also in the output of ls /. If you rm /test you'll notice that it's also gone from /root/chroot/. So / and /root/chroot/ are exactly the same place.

If you want to look in slightly more detail, run stat / and then stat /root/chroot and you'll notice that both return the same Inode. An Inode is a data structure that refers to a particular file/directory on the disk. As they both return the same Inode then both paths are pointing to exactly the same directory.

Step 3 therefore bind mounts the /root/tmp directory over the system /tmp directory within the already bind mounted /root/chroot.

When you chroot in step 4, you'll be in a chrooted / using the /tmp directory in /root instead of the system wide /tmp. This way, the chroot isn't sharing a /tmp with every other user on the system.

Answer 2

mkdir -p /root/chroot /root/tmp

Create directories to be used for chroot'ed environment. /root/chroot will be the root directory of your chroot'ed environment. /root/tmp will act as a /tmp directory of your chroot'ed environment.

mount --bind / /root/chroot

This will make your / directory accessible via /root/chroot. Think about this as mirroring / directory on /root/chroot (even though it's not really a mirror, it's a pointer to /).

mount --bind /root/tmp /root/chroot/tmp

This will make your custom /root/tmp directory accessible via a /tmp directory of you chroot'ed environment. This way your chroot'ed environment will have it's /tmp directory separated from system's /tmp. If you skip this step then chroot'ed /tmp directory will point to your system's /tmp directory.

chroot /root/chroot

Here you enter your chroot'ed environment.

Now your questions:

1. Does the first mount command affect the second one?

   Yes. You need to bind mount the root of your chroot'ed environment (/root/chroot), before you can bind it's /tmp directory. /root/chroot/tmp won't exist before you bind / to /root/chroot.

2. On the second step they are binding the new directory /root/chroot to the root directory. Does that mean that on the third step /root/tmp actually points to /root/chroot/root/tmp?

   Yes. Everything on / will be accessible via /root/chroot.

3. Where does /root/chroot/tmp come from?

   /root/chroot/tmp comes into existence after you bind / to /root/chroot in step 2.