I've booted a live-cd in order to download, compile and install a few packages on a otherwise working system without actually booting said system.
I've created a build user on the system by issuing
useradd -m -G wheel -s /bin/bash builder
I then proceed to mounting my partition and a chroot environment:
# mount /dev/mapper/luksdev on /mnt # cd /mnt # cp /etc/resolv.conf etc # mount -t proc /proc proc # mount --make-rslave --rbind /sys sys # mount --make-rslave --rbind /dev dev # mount --make-rslave --rbind /run run # chroot /mnt /bin/bash
After this, I clone, chown and move into the project to build.
(chroot)# git clone https://aur.archlinux.org/lighttpd2-git.git /home/builder/lighttpd2 (chroot)# chown -R builder.builder /home/builder/lighttpd2 (chroot)# sudo -u builder -s (chroot|builder ~)$ cd /home/builder/lighttpd2/ (chroot|builder lighttpd2)$ /usr/bin/makepkg -s --noconfirm
As root, I have no issues performing name lookups, so the
git clone will work as inteded. But switching to any other user during the build process of this package (or if I run the
git clone as non-root), I will get:
fatal: unable to access 'https://git.lighttpd.net/lighttpd/lighttpd2.git/': Could not resolve host: git.lighttpd.net
So I thought of doing simple
ping check to isolate the issue. Doing
ping www.google.com works as
root, but not as
ping 220.127.116.11 works for both
(chroot)# ping -c 1 www.google.com PING www.google.com (18.104.22.168) 56(84) bytes of data. 64 bytes from arn09s11-in-f164.1e100.net (22.214.171.124): icmp_seq=1 ttl=55 time=2.03 ms (chroot|builder)$ ping -c 1 www.google.com ping: www.google.com: Name or service not known (chroot)# ping -c 1 126.96.36.199 PING 188.8.131.52 (184.108.40.206) 56(84) bytes of data. 64 bytes from 220.127.116.11: icmp_seq=1 ttl=121 time=1.97 ms (chroot|builder)$ ping -c 1 18.104.22.168 PING 22.214.171.124 (126.96.36.199) 56(84) bytes of data. 64 bytes from 188.8.131.52: icmp_seq=1 ttl=121 time=1.98 ms
logically, I thought it has to do with the name resolutions for the specific user.. But doing:
(chroot)# nslookup www.google.com Server: 184.108.40.206 Name: www.google.com Address: 220.127.116.11 (chroot|builder)$ nslookup www.google.com Server: 18.104.22.168 Name: www.google.com Address: 22.214.171.124
Both users can do nslookup and shows that
/etc/resolv.conf is present and works. But pinging a hostname or using any type of name-resolve tasks outside of nslookup/dig won't work:
(chroot|builder)$ python >>> from socket import * >>> s = socket() >>> s.connect(('www.google.com', 80)) socket.gaierror: [Errno -2] Name or service not known
I tried sticking solely to ping to keep things simple.
I've also tried making sure nothing's blocking my ping usage:
(chroot)# chown root:root /bin/ping; chmod u+srwx,go=rx /bin/ping (chroot)# getcap /usr/bin/ping /usr/bin/ping = cap_net_raw+ep
But even then, I'm not allowed to ping using hostnames, but IP's still work.
(chroot|builder)$ strace ping www.google.com socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCESS (Permission denied) socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Operation not permitted) write(2, "ping: socket: Operation not perm"..., 38ping: socket: Operation not permitted)= 38
/root are not mounted with
nosuid either. Sadly, this is a VM so I can only supply a screenshot of it.
Since I'm trying ping from
/home, I don't see a reason why this would cause the issue either. If I boot into the system, and do the exact same thing with the user I created during the live-cd boot.. I can ping hostnames.
At this point I mainly want to understand why some users can perform ping, lookups etc. And some don't during a chroot environment. I'm not sure where to debug/continue from here on in order to try and fix or understand the underlying problem. A couple of helpful souls over at IRC also tried to give a helping hand but we're all baffled.
I've narrowed it down to the
mount --make-rslave --rbind /run run being the issue. It's the cause for whatever reason. If I try to
ping www.google.com after each
mount command (at the start of the question), it stops right after
/run is mounted.