I've booted a live-cd in order to download, compile and install a few packages on a otherwise working system without actually booting said system.

I've created a build user on the system by issuing useradd -m -G wheel -s /bin/bash builder

I then proceed to mounting my partition and a chroot environment:

# mount /dev/mapper/luksdev on /mnt
# cd /mnt
# cp /etc/resolv.conf etc
# mount -t proc /proc proc
# mount --make-rslave --rbind /sys sys
# mount --make-rslave --rbind /dev dev
# mount --make-rslave --rbind /run run
# chroot /mnt /bin/bash

After this, I clone, chown and move into the project to build.

(chroot)# git clone https://aur.archlinux.org/lighttpd2-git.git /home/builder/lighttpd2
(chroot)# chown -R builder.builder /home/builder/lighttpd2
(chroot)# sudo -u builder -s
(chroot|builder ~)$ cd /home/builder/lighttpd2/
(chroot|builder lighttpd2)$ /usr/bin/makepkg -s --noconfirm

As root, I have no issues performing name lookups, so the git clone will work as inteded. But switching to any other user during the build process of this package (or if I run the git clone as non-root), I will get:

fatal: unable to access 'https://git.lighttpd.net/lighttpd/lighttpd2.git/': Could not resolve host: git.lighttpd.net

So I thought of doing simple ping check to isolate the issue. Doing ping www.google.com works as root, but not as builder. However, doing ping works for both root & builder.

(chroot)# ping -c 1 www.google.com
PING www.google.com ( 56(84) bytes of data.
64 bytes from arn09s11-in-f164.1e100.net ( icmp_seq=1 ttl=55 time=2.03 ms

(chroot|builder)$ ping -c 1 www.google.com
ping: www.google.com: Name or service not known

(chroot)# ping -c 1
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=121 time=1.97 ms

(chroot|builder)$  ping -c 1
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=121 time=1.98 ms

logically, I thought it has to do with the name resolutions for the specific user.. But doing:

(chroot)# nslookup www.google.com
Name:      www.google.com

(chroot|builder)$ nslookup www.google.com
Name:      www.google.com

Both users can do nslookup and shows that /etc/resolv.conf is present and works. But pinging a hostname or using any type of name-resolve tasks outside of nslookup/dig won't work:

(chroot|builder)$ python
>>> from socket import *
>>> s = socket()
>>> s.connect(('www.google.com', 80))
socket.gaierror: [Errno -2] Name or service not known

I tried sticking solely to ping to keep things simple.
I've also tried making sure nothing's blocking my ping usage:

(chroot)# chown root:root /bin/ping; chmod u+srwx,go=rx /bin/ping
(chroot)# getcap /usr/bin/ping
/usr/bin/ping = cap_net_raw+ep

But even then, I'm not allowed to ping using hostnames, but IP's still work.

(chroot|builder)$ strace ping www.google.com
socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCESS (Permission denied)
socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Operation not permitted)
write(2, "ping: socket: Operation not perm"..., 38ping: socket: Operation not permitted)= 38

/home and /root are not mounted with nosuid either. Sadly, this is a VM so I can only supply a screenshot of it.

Since I'm trying ping from /home, I don't see a reason why this would cause the issue either. If I boot into the system, and do the exact same thing with the user I created during the live-cd boot.. I can ping hostnames.

At this point I mainly want to understand why some users can perform ping, lookups etc. And some don't during a chroot environment. I'm not sure where to debug/continue from here on in order to try and fix or understand the underlying problem. A couple of helpful souls over at IRC also tried to give a helping hand but we're all baffled.


I've narrowed it down to the mount --make-rslave --rbind /run run being the issue. It's the cause for whatever reason. If I try to ping www.google.com after each mount command (at the start of the question), it stops right after /run is mounted.

enter image description here

  • Which live-cd distribution are you using? Does it possibly have an Linux Security Module in place? Like SELinux or apparmor for instance – LL3 Apr 10 at 1:26
  • 1
    Instead of a chroot, what happens if you use systemd-nspawn to start a container in it? – muru Apr 10 at 5:47
  • 1
    @muru That works. I used systemd-nspawn -D /mnt --machine test, seeing as I've never used systemd-nspawn I'd greatly appreciate it if I got any pointers if that's the wrong way of doing it. /run is empty when doing this with the exception of systemd being in there. But it sure works. – Torxed Apr 10 at 6:07
  • 1
    @Torxed that's pretty much how I use it too (except I may add -b if I want some service within the chroot to start as well, but you probably don't need it). I gave up on messing around with mounts and networking with chroot and switched to systemd-nspawn because of problems like this. – muru Apr 10 at 6:13
  • 1
    @muru I'm starting to feel the pain and understand why you did. I suggest you do a write-up on the solution. I'll mark it as a appropriate answer in a day or two if no one else has an answer to the original problem of why this happens. – Torxed Apr 10 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.