4

If I got it right, chroot restricts user's access to a given directory only. Looks like useradd has this option (Debian 10).

# useradd --help | grep "chroot"
  -R, --root CHROOT_DIR         directory to chroot into

Looks simple, yet nobody seems to be recommending it:

Why? Is it not portable or secure/reliable enough?

1

1 Answer 1

4

You misunderstood the purpose and behaviour of -R options on useradd.

In my understanding, it has nothing to deal with chrooting a user: this switch allow to modify a the authentication files (/etc/passwd + /etc/shadow) on another directory than /. This can be useful for example to manage users of a LXC container.

Demonstration:

/tmp$ mkdir fakeroot
/tmp$ mkdir fakeroot/etc
/tmp$ touch fakeroot/etc/{shadow,passwd}
/tmp$ find fakeroot/
fakeroot/
fakeroot/etc
fakeroot/etc/shadow
fakeroot/etc/passwd
/tmp$ sudo useradd -R /tmp/fakeroot toto
/tmp$ cat /tmp/fakeroot/etc/* 
toto:!:1000:
toto:x:1000:1000::/home/toto:
cat: /tmp/fakeroot/etc/passwd-: Permission denied
toto:!:18263:0:99999:7:::
cat: /tmp/fakeroot/etc/shadow-: Permission denied
/tmp$ grep toto /etc/passwd
/tmp$

As you may see, the useradd command only modified the files under /tmp/fakeroot and leaved untouched my system file under /etc/

3
  • Thank you for the examples! Commented Jan 3, 2020 at 9:18
  • Quick question, once you create this user toto, how do you used it to login to the chroot environment?
    – usamazf
    Commented Nov 18, 2021 at 14:29
  • It totally depends on your chroot environment. In fact, the -R switch only prefix "/etc/" with the path you gave, that's all. It may be usefull for creating (,...) a user for a LXC environment or a chroot environment you managed to create before. I can also be useful when booting in rescue mode, to operate against the "real" system account database after mouting your hard drive for example.
    – binarym
    Commented Nov 24, 2021 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .