3

I'm trying to create a little container that will let me remap /dev/random to /dev/urandom without root for a specific program. What I have so far:

unshare -r bash -c 'chroot . /bin/busybox sh'

For the most part, this seems to act as a full chroot, equivalent to sudo chroot . /bin/busybox sh, but one problem: When I try to mknod somefile c 1 9, I get operation not permitted. This works in a standard chroot. Is it possible to get around this? If not, is there a better way to do what I am attempting?

Please don't drown me in comments about the security of random vs urandom. That's not what this is about.

|improve this question
  • Why not make a symbolic link? – Gilles Aug 19 '16 at 23:20
  • It would be dangling. You can't access outside a chroot. – Duncan X Simpson Aug 19 '16 at 23:48
  • Aren't you bind-mounting /dev in your chroot? – Gilles Aug 19 '16 at 23:48
  • I need to do this without root on the host. – Duncan X Simpson Aug 19 '16 at 23:49
1

If the program is dynamically linked, you can override the file opening function by preloading a library. See Redirect a file descriptor before execution for some sample code; replace /dev/null by /dev/urandom and set PATH_TO_OVERRIDE=/dev/random in the build command.

|improve this answer
  • I don't want to have to recompile it every time it updates I'll use this if I have no other options, but ideally I can just use the user's installed version. With my unshared chroot I would copy it on install. – Duncan X Simpson Aug 20 '16 at 1:40
  • @VirtualDXS Recompile what? That library is something you compile once and for all. You don't need to recompile the program you're running, you don't even need to have the source code, that's the point of preloading a library. – Gilles Aug 20 '16 at 9:49
  • Ohhhhh, I see. This seems perfect. Upvoted, and I'll accept once I try it out. – Duncan X Simpson Aug 20 '16 at 14:51
  • With the latest version of that answer, this works great. Thanks! – Duncan X Simpson Aug 21 '16 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.