5

The goal is to install and run programs in a displaced (relocated) distro (whose / must not coincide with the global /) inside a host Linux system. The programs are not adapted for using a different / .

fakechroot is not a complete solution because it employs library-substitution instead of acting on the level of system calls (so not good for statically linked binaries).

9

The solution must probably be based either on ptrace or namespaces (unshare).

ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably).

ptrace-based

UMView

As for ptrced-based solutions, thanks to the comments at https://stackoverflow.com/a/1019720/94687, I've discovered UMView:

The linked docs describe how to have a "copy-on-write view" of the host fs -- that's not exactly like performing a chroot. Exact intructions on how to achieve /-substitution in umview would be nice to have in an answer to my question (please write one if you figure out how to do this!).

umview must be open-source, because it is included in Ubuntu and Debian -- http://packages.ubuntu.com/lucid/umview.

"Confining programs"

Another implementation is described in http://www.cs.vu.nl/~rutger/publications/jailer.pdf, http://www.cs.vu.nl/~guido/mansion/publications/ps/secrypt07.pdf.

They have a change-root-ing policy rule, CHRDIR, whose effect is similar to chroot. (Section "The jailing policy")

However, they might have not published their source code (partially based on a modified strace http://www.liacs.nl/~wichert/strace/ -- Section "Implementation")...

geordi

Geordi (http://www.eelis.net/geordi/, https://github.com/Eelis/geordi) could probably be modified to make the wanted rewriting of file arguments to system calls in the jailed programs.

proot

PRoot is a ready to use ptrace-based tool for this. http://proot.me/:

chroot equivalent

To execute a command inside a given Linux distribution, just give proot the path to the guest rootfs followed by the desired command. The example below executes the program cat to print the content of a file:

proot -r /mnt/slackware-8.0/ cat /etc/motd

Welcome to Slackware Linux 8.0

The default command is /bin/sh when none is specified. Thus the shortest way to confine an interactive shell and all its sub-programs is:

proot -r /mnt/slackware-8.0/

$ cat /etc/motd
Welcome to Slackware Linux 8.0

unshare-based

user_namespaces support in the Linux kernel has got more mature since when the question was asked. Now you can play with performing a chroot as a normal with the help of unshare like in Simulate chroot with unshare:

unshare --user --map-root-user --mount-proc --pid --fork
chroot ......
su - user1
  • You ask and answer simultaneosly? – Hauke Laging Apr 17 '13 at 4:22
  • @HaukeLaging It's encouraged if you think the info will be useful for others – Michael Mrozek Apr 17 '13 at 23:35
  • @HaukeLaging As I posed this question to myself (and started writing the question down), I started searching for the solutions, so very soon I got already an understanding of the possible solutions, and wrote that down as an answer. A bit later I discoveren one more tool to do this (proot), perhaps the most convenient, and added it to the answer. – imz -- Ivan Zakharyaschev Apr 20 '13 at 13:11
  • 1
    bubblewrap is a really nice unshare-based chroot/mount --bind replacement: github.com/projectatomic/bubblewrap – user2303 Sep 30 '16 at 13:45
1

You could try User-Mode Linux. The code for building such a kernel is now present in the mainstream sources, and you can find (outdated) precompiled builds on the page I linked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.