4

If I got it right, chroot restricts user's access to a given directory only. Looks like useradd has this option (Debian 10).

# useradd --help | grep "chroot"
  -R, --root CHROOT_DIR         directory to chroot into

Looks simple, yet nobody seems to be recommending it:

Why? Is it not portable or secure/reliable enough?

1

1 Answer 1

5

You misunderstood the purpose and behaviour of -R options on useradd.

In my understanding, it has nothing to deal with chrooting a user: this switch allow to modify a the authentication files (/etc/passwd + /etc/shadow) on another directory than /. This can be useful for example to manage users of a LXC container.

Demonstration:

/tmp$ mkdir fakeroot
/tmp$ mkdir fakeroot/etc
/tmp$ touch fakeroot/etc/{shadow,passwd}
/tmp$ find fakeroot/
fakeroot/
fakeroot/etc
fakeroot/etc/shadow
fakeroot/etc/passwd
/tmp$ sudo useradd -R /tmp/fakeroot toto
/tmp$ cat /tmp/fakeroot/etc/* 
toto:!:1000:
toto:x:1000:1000::/home/toto:
cat: /tmp/fakeroot/etc/passwd-: Permission denied
toto:!:18263:0:99999:7:::
cat: /tmp/fakeroot/etc/shadow-: Permission denied
/tmp$ grep toto /etc/passwd
/tmp$

As you may see, the useradd command only modified the files under /tmp/fakeroot and leaved untouched my system file under /etc/

3
  • Thank you for the examples!
    – mehov
    Jan 3, 2020 at 9:18
  • Quick question, once you create this user toto, how do you used it to login to the chroot environment?
    – usamazf
    Nov 18, 2021 at 14:29
  • It totally depends on your chroot environment. In fact, the -R switch only prefix "/etc/" with the path you gave, that's all. It may be usefull for creating (,...) a user for a LXC environment or a chroot environment you managed to create before. I can also be useful when booting in rescue mode, to operate against the "real" system account database after mouting your hard drive for example.
    – binarym
    Nov 24, 2021 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.