6

I have set up a chroot jail for user chroottest in /home/chroot

Steps to reproduce:

root@pc# mkdir /home/chroot
root@pc# mkdir /home/chroot/dev
root@pc# mkdir /home/chroot/etc
root@pc# mkdir /home/chroot/bin
root@pc# mkdir /home/chroot/usr
root@pc# mkdir /home/chroot/usr/bin
root@pc# mkdir /home/chroot/usr/lib
root@pc# mkdir /home/chroot/usr/lib/terminfo
root@pc# mkdir /home/chroot/lib
root@pc# mkdir /home/chroot/lib/x86_64-linux-gnu
root@pc# mkdir /home/chroot/lib64
root@pc# 
root@pc# mknod -m 666 null c 1 3
root@pc# mknod -m 666 tty c 5 0
root@pc# mknod -m 666 zero c 1 5
root@pc# mknod -m 666 random c 1 8
root@pc# 
root@pc# cp /bin/bash /home/chroot/bin
root@pc# cp /usr/bin/ls /home/chroot/usr/bin
root@pc# cp /usr/bin/getent /home/chroot/usr/bin
root@pc# cp -av /usr/lib/terminfo /home/chroot/usr/lib/terminfo
root@pc#
root@pc# cp /lib/x86_64-linux-gnu/libtinfo.so.6 /home/chroot/lib/x86_64-linux-gnu/                           
root@pc# cp /lib/x86_64-linux-gnu/libdl.so.2 /home/chroot/lib/x86_64-linux-gnu/                    
root@pc# cp /lib/x86_64-linux-gnu/libc.so.6 /home/chroot/lib/x86_64-linux-gnu/
root@pc# cp /lib/x86_64-linux-gnu/libpthread.so.0 /home/chroot/lib/x86_64-linux-gnu/
root@pc# cp /lib/x86_64-linux-gnu/libselinux.so.1 /home/chroot/lib/x86_64-linux-gnu/
root@pc# cp /lib/x86_64-linux-gnu/libpcre2-8.so.0 /home/chroot/lib/x86_64-linux-gnu/
root@pc# cp /lib64/ld-linux-x86-64.so.2 /home/chroot/lib64/
root@pc#
root@pc# useradd chroottest -s /bin/bash
root@pc# passwd chroottest
root@pc#
root@pc# cp /etc/passwd /home/chroot/etc/
root@pc# cp /etc/group /home/chroot/etc/
root@pc# cp /etc/nsswitch.conf /home/chroot/etc/
root@pc# 
root@pc# echo -e "Match User chroottest\n\tChrootDirectory /home/chroot" >> /etc/ssh/sshd_config
root@pc# systemctl reload sshd

When I connect via ssh as the user chroottest, I get chrooted correctly, but expected output of "ls -lh" would be

chroottest@pc# ls -lh
total 24K
drwxr-xr-x 2 root root 4.0K Nov  8 20:36 bin
drwxr-xr-x 2 root root 4.0K Nov  8 20:35 dev
drwxr-xr-x 2 root root 4.0K Nov  8 20:41 etc
drwxr-xr-x 3 root root 4.0K Nov  8 20:37 lib
drwxr-xr-x 2 root root 4.0K Nov  8 20:38 lib64
drwxr-xr-x 5 root root 4.0K Nov  8 21:00 usr

But it is

drwxr-xr-x  2   0   0 4.0K Nov  5 13:52 bin
drwxr-xr-x  2   0   0 4.0K Oct 22 05:47 dev
drwxr-xr-x  2   0   0 4.0K Nov  5 14:02 etc
drwxr-xr-x  4   0   0 4.0K Nov  5 13:57 lib
drwxr-xr-x  2   0   0 4.0K Oct 22 05:51 lib64
drwxr-xr-x  3   0   0 4.0K Nov  5 13:54 usr

I only see IDs instead of usernames and groups. File system rights are impossible to manage that way...

The content of nsswitch.conf ist:

root@pc# cat /home/chroot/etc/nsswitch.conf
passwd:         files systemd
group:          files systemd
shadow:         files
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

getent seems to be unable to get any information in the chroot environment:

chroottest@pc# getent passwd
chroottest@pc# getent passwd chroottest
chroottest@pc#

Any idea on what could be the problem?

Thanks, Mike

4
  • upvote for well documented question
    – jsotola
    Commented Nov 9, 2020 at 21:34
  • 2
    Maybe you want to put the /etc/nsswitch.conf file within the chroot as well. It tells the GNU C Library where to get the data for users (passwd db). You may also want to add, temporarily, the getent utility inside it too, for debug purposes. Running getent passwd will output the passwd db that the C library is using.
    – Totor
    Commented Nov 9, 2020 at 22:29
  • Thanks for the hints, I copied nsswitch.conf and getent to the chroot environment, but the problem persists. I edited my original question to include the steps I have taken according to your suggestions.
    – mfischer
    Commented Nov 10, 2020 at 8:35
  • 1
    Copy /lib/x86_64-linux-gnu/libnss_files.so.2 as well. Commented Nov 10, 2020 at 12:05

1 Answer 1

1

Ferenc Wágner's and Totor's comments combined gave me the answer:

You have to copy /etc/nsswitch.conf and libnss.files.so.2 library to the chroot environment as well for the system to be able to interpret users and groups from passwd and group files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .