Cannot create root jail

Question

I just tried to play around with chroot command only for testing purposes, in order to create a temporary root jail, but I didn't managed to. The platform is CentOS 6.4. and I have done it numerous times so far except for now. I followed the procedure in that order:

1. Create bin, etc, home, lib, and var directories.
2. ldd /bin/bash
3. Copy all libraries in above mentioned lib directory plus /bin/bash binary in bin.

4. Then ran chroot /path/to/the/jail and the following appeared:

   chroot: failed to run command `/bin/bash': No such file or directory
   

I am not able to establish where this error comes from and also I have never had such a problem. The same procedure works just fine in Ubuntu server. The problem occurs only on this particular server.

Per comments below, here is some output from debugging commands:

[root@localhost chroot]# find -printf '%M %p\n'
 drwxr-xr-x .
 drwxr-xr-x ./bin
 -rwxr-xr-x ./bin/bash
 drwxr-xr-x ./var
 drwxr-xr-x ./var/var
 drwxr-xr-x ./home
 drwxr-xr-x ./lib
 -rwxr-xr-x ./lib/libdl.so.2
 -rwxr-xr-x ./lib/libc.so.6
 -rwxr-xr-x ./lib/libtinfo.so.5
 -rwxr-xr-x ./lib/ld-linux-x86-64.so.2
 drwxr-xr-x ./etc

[root@localhost bin]# ldd /mnt/proba1/chroot/bin/bash
 linux-vdso.so.1 => (0x00007fff6fe00000)
 libtinfo.so.5 => /lib64/libtinfo.so.5 (0x00007f12cdd40000)
 libdl.so.2 => /lib64/libdl.so.2 (0x00007f12cdb38000)
 libc.so.6 => /lib64/libc.so.6 (0x00007f12cd7a0000)
 /lib64/ld-linux-x86-64.so.2 (0x00007f12cdf70000)

Answer 1

The ldd output shows that bash is expecting to find its libraries in /lib64, not /lib. Also, this means you have to copy them from /lib64 into the corresponding directory inside the jail. The same files found in /lib won't work.

Answer 2

What I do is I use "mount --bind" for this. You can also make it read-only. eg:

mkdir test
cd test
mkdir bin sbin usr etc
mount --bind -o ro /bin bin
mount --bind -o ro /sbin sbin
mount --bind -o ro /usr usr
mount --bind -o ro /etc etc
chroot .

This isn't completely, but you get the idea. This can get really cool if you use "aufs" as well. It allows you to layer a writable layer on top of a readable layer. That way, you don't end up having to copy, bind-mount it read-only, yet still make it writable, while all the writes are kept in a placeholder somewhere. Another thing to try is using 'cp -l' link-copying. And then "cow" which means copy-on-write. What that does is it first makes a copy, but all the directory entries pointing to the same nodes on disk. It looks like a copy, but they're all linked. Not symbolically linked, but hard linked. Cow makes it so that the moment you try to write to the file, that file's actual content first gets copied, and that then gets modified.