3

I'm trying to create a little container that will let me remap /dev/random to /dev/urandom without root for a specific program. What I have so far:

unshare -r bash -c 'chroot . /bin/busybox sh'

For the most part, this seems to act as a full chroot, equivalent to sudo chroot . /bin/busybox sh, but one problem: When I try to mknod somefile c 1 9, I get operation not permitted. This works in a standard chroot. Is it possible to get around this? If not, is there a better way to do what I am attempting?

Please don't drown me in comments about the security of random vs urandom. That's not what this is about.

4
  • Why not make a symbolic link? Commented Aug 19, 2016 at 23:20
  • It would be dangling. You can't access outside a chroot. Commented Aug 19, 2016 at 23:48
  • Aren't you bind-mounting /dev in your chroot? Commented Aug 19, 2016 at 23:48
  • I need to do this without root on the host. Commented Aug 19, 2016 at 23:49

1 Answer 1

1

If the program is dynamically linked, you can override the file opening function by preloading a library. See Redirect a file descriptor before execution for some sample code; replace /dev/null by /dev/urandom and set PATH_TO_OVERRIDE=/dev/random in the build command.

4
  • I don't want to have to recompile it every time it updates I'll use this if I have no other options, but ideally I can just use the user's installed version. With my unshared chroot I would copy it on install. Commented Aug 20, 2016 at 1:40
  • @VirtualDXS Recompile what? That library is something you compile once and for all. You don't need to recompile the program you're running, you don't even need to have the source code, that's the point of preloading a library. Commented Aug 20, 2016 at 9:49
  • Ohhhhh, I see. This seems perfect. Upvoted, and I'll accept once I try it out. Commented Aug 20, 2016 at 14:51
  • With the latest version of that answer, this works great. Thanks! Commented Aug 21, 2016 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .